ci(release): grant contents:write to the release workflow

The workflow creates a GitHub release and uploads assets, which needs the contents:write token scope. Declaring it per-workflow (matching release-launcher.yml on main) lets the repo keep a read-only default GITHUB_TOKEN.

Dockerfile

@@ -1,14 +1,14 @@
 # DorkNet.Server container image — Coolify deploy target.
 # ────────────────────────────────────────────────────────────────────
 # Multi-stage: SDK image builds + publishes, runtime image is the
-# slimmer aspnet:10.0 with only the published output.
+# slimmer aspnet:9.0 with only the published output.
 #
 # Build context: repo root (so Tools/ and DorkNet.Models/ are visible
 # to ProjectReference + dotnet restore). The .dockerignore at the
 # repo root keeps the bin/, obj/, and other dev junk out of the
 # context.
 
-ARG DOTNET_VERSION=10.0
+ARG DOTNET_VERSION=9.0
 ARG NODE_VERSION=20
 
 # ── admin SPA build stage ──────────────────────────────────────────
@@ -53,14 +53,12 @@ WORKDIR /src
 # DorkNet.Models project ref, so its csproj needs to be present too.
 COPY DorkNet.Server/DorkNet.Server.csproj DorkNet.Server/
 COPY DorkNet.Models/DorkNet.Models.csproj DorkNet.Models/
-COPY DorkNet.Contracts/DorkNet.Contracts.csproj DorkNet.Contracts/
 RUN dotnet restore DorkNet.Server/DorkNet.Server.csproj
 
 # Now copy the rest of the .NET source, then drop the prebuilt admin
 # SPA into wwwroot/admin so the publish step ships it as static content.
 COPY DorkNet.Server/ DorkNet.Server/
 COPY DorkNet.Models/ DorkNet.Models/
-COPY DorkNet.Contracts/ DorkNet.Contracts/
 COPY --from=admin-ui /wwwroot/admin/ DorkNet.Server/wwwroot/admin/
 COPY --from=site      /wwwroot/site/  DorkNet.Server/wwwroot/site/
 
@@ -78,13 +76,13 @@ WORKDIR /app
 
 # curl + wget for healthcheck probes — Coolify v4 defaults to wget for
 # its own probe regardless of what the image's HEALTHCHECK uses, so
-# both have to be present. The aspnet:10.0 base image strips both by
+# both have to be present. The aspnet:9.0 base image strips both by
 # default to keep the surface area small.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl wget \
     && rm -rf /var/lib/apt/lists/*
 
-# Run as a non-root user — aspnet:10.0 ships with the `app` UID 1654.
+# Run as a non-root user — aspnet:9.0 ships with the `app` UID 1654.
 # Coolify mounts persistent volumes with write permission for this UID.
 USER app
 

Dockerfile.service

@@ -1,4 +1,4 @@
-ARG DOTNET_VERSION=10.0
+ARG DOTNET_VERSION=9.0
 ARG NODE_VERSION=20
 
 FROM node:${NODE_VERSION}-alpine AS admin-ui

DorkNet.ClientMod/Mod.cs

@@ -610,7 +610,17 @@ public class Mod : MelonMod
     {
         try
         {
-            var userData = ResolveUserDataDirectory();
+            // Compute the UserData path ourselves rather than calling
+            // MelonLoader.MelonUtils.UserDataDirectory (which is renamed
+            // to MelonEnvironment.UserDataDirectory in newer 0.6.x builds
+            // and shifts again in 0.7.x). Anchoring off the mod DLL's
+            // location keeps this stable across versions: the DLL lives
+            // in <game>/Mods/, so two dirname()'s reach the game root,
+            // then MelonLoader/UserData/ is right next to it.
+            var modDll = Assembly.GetExecutingAssembly().Location;
+            var modsDir = Path.GetDirectoryName(modDll) ?? string.Empty;
+            var gameDir = Path.GetDirectoryName(modsDir) ?? string.Empty;
+            var userData = Path.Combine(gameDir, "MelonLoader", "UserData");
             Directory.CreateDirectory(userData);
             DiagnosticsLogPath = Path.Combine(userData, "dorknet-diagnostics.log");
             var path = Path.Combine(userData, "dorknet-clientmod.json");
@@ -621,21 +631,21 @@ public class Mod : MelonMod
             }
             var doc = JsonDocument.Parse(File.ReadAllText(path));
             var r = doc.RootElement;
-            if (TryGetConfigValue(r, "ServerHost", out var v))           Cfg.ServerHost = v.GetString() ?? Cfg.ServerHost;
-            if (TryGetConfigValue(r, "PhotonAppId", out v))              Cfg.PhotonAppId = v.GetString() ?? Cfg.PhotonAppId;
-            if (TryGetConfigValue(r, "PhotonVoiceAppId", out v))         Cfg.PhotonVoiceAppId = v.GetString() ?? Cfg.PhotonVoiceAppId;
-            if (TryGetConfigValue(r, "PhotonCloudRegion", out v))        Cfg.PhotonCloudRegion = v.GetString() ?? Cfg.PhotonCloudRegion;
-            if (TryGetConfigValue(r, "EnableTlsTrustBypass", out v))     Cfg.EnableTlsTrustBypass = v.GetBoolean();
-            if (TryGetConfigValue(r, "TraceRegistrationDialog", out v))  Cfg.TraceRegistrationDialog = v.GetBoolean();
-            if (TryGetConfigValue(r, "EnableDebugConsole", out v))       Cfg.EnableDebugConsole = v.GetBoolean();
-            if (TryGetConfigValue(r, "DebugConsoleToggleKey", out v))    Cfg.DebugConsoleToggleKey = v.GetString() ?? Cfg.DebugConsoleToggleKey;
-            if (TryGetConfigValue(r, "DesktopScreenShareFps", out v))             Cfg.DesktopScreenShareFps = (float)v.GetDouble();
-            if (TryGetConfigValue(r, "DesktopScreenShareRaisePhotonRate", out v)) Cfg.DesktopScreenShareRaisePhotonRate = v.GetBoolean();
-            if (TryGetConfigValue(r, "DesktopScreenShareResolution", out v))      Cfg.DesktopScreenShareResolution = v.GetInt32();
-            if (TryGetConfigValue(r, "DesktopScreenShareQuality", out v))         Cfg.DesktopScreenShareQuality = v.GetInt32();
-            if (TryGetConfigValue(r, "DiagnoseDevMenu", out v))                   Cfg.DiagnoseDevMenu = v.GetBoolean();
-            if (TryGetConfigValue(r, "QuestMaxTeamSize", out v))                  Cfg.QuestMaxTeamSize = v.GetInt32();
-            if (TryGetConfigValue(r, "QuestMaxTeamSizeRooms", out v) && v.ValueKind == JsonValueKind.Array)
+            if (r.TryGetProperty("ServerHost", out var v))           Cfg.ServerHost = v.GetString() ?? Cfg.ServerHost;
+            if (r.TryGetProperty("PhotonAppId", out v))              Cfg.PhotonAppId = v.GetString() ?? Cfg.PhotonAppId;
+            if (r.TryGetProperty("PhotonVoiceAppId", out v))         Cfg.PhotonVoiceAppId = v.GetString() ?? Cfg.PhotonVoiceAppId;
+            if (r.TryGetProperty("PhotonCloudRegion", out v))        Cfg.PhotonCloudRegion = v.GetString() ?? Cfg.PhotonCloudRegion;
+            if (r.TryGetProperty("EnableTlsTrustBypass", out v))     Cfg.EnableTlsTrustBypass = v.GetBoolean();
+            if (r.TryGetProperty("TraceRegistrationDialog", out v)) Cfg.TraceRegistrationDialog = v.GetBoolean();
+            if (r.TryGetProperty("EnableDebugConsole", out v))      Cfg.EnableDebugConsole = v.GetBoolean();
+            if (r.TryGetProperty("DebugConsoleToggleKey", out v))   Cfg.DebugConsoleToggleKey = v.GetString() ?? Cfg.DebugConsoleToggleKey;
+            if (r.TryGetProperty("DesktopScreenShareFps", out v))             Cfg.DesktopScreenShareFps = (float)v.GetDouble();
+            if (r.TryGetProperty("DesktopScreenShareRaisePhotonRate", out v)) Cfg.DesktopScreenShareRaisePhotonRate = v.GetBoolean();
+            if (r.TryGetProperty("DesktopScreenShareResolution", out v))      Cfg.DesktopScreenShareResolution = v.GetInt32();
+            if (r.TryGetProperty("DesktopScreenShareQuality", out v))         Cfg.DesktopScreenShareQuality = v.GetInt32();
+            if (r.TryGetProperty("DiagnoseDevMenu", out v))                   Cfg.DiagnoseDevMenu = v.GetBoolean();
+            if (r.TryGetProperty("QuestMaxTeamSize", out v))                  Cfg.QuestMaxTeamSize = v.GetInt32();
+            if (r.TryGetProperty("QuestMaxTeamSizeRooms", out v) && v.ValueKind == JsonValueKind.Array)
             {
                 var rooms = new List<string>();
                 foreach (var e in v.EnumerateArray())
@@ -643,8 +653,8 @@ public class Mod : MelonMod
                         rooms.Add(e.GetString()!);
                 Cfg.QuestMaxTeamSizeRooms = rooms.ToArray(); // explicit (incl. empty = none)
             }
-            if (TryGetConfigValue(r, "EnableDevWatchButton", out v))          Cfg.EnableDevWatchButton = v.GetBoolean();
-            if (TryGetConfigValue(r, "DevCommands", out v) && v.ValueKind == JsonValueKind.Array)
+            if (r.TryGetProperty("EnableDevWatchButton", out v))              Cfg.EnableDevWatchButton = v.GetBoolean();
+            if (r.TryGetProperty("DevCommands", out v) && v.ValueKind == JsonValueKind.Array)
             {
                 var list = new List<string>();
                 foreach (var e in v.EnumerateArray())
@@ -656,7 +666,7 @@ public class Mod : MelonMod
             }
             // "InjectAuthValues" key in the template is now ignored —
             // see attic/AuthValuesInjector.cs.attic.
-            Log.Msg($"[config] loaded from {path}: ServerHost={Cfg.ServerHost}, PhotonAppId={(string.IsNullOrEmpty(Cfg.PhotonAppId) ? "<unset>" : "<set>")}, " +
+            Log.Msg($"[config] loaded: ServerHost={Cfg.ServerHost}, PhotonAppId={(string.IsNullOrEmpty(Cfg.PhotonAppId) ? "<unset>" : "<set>")}, " +
                     $"EnableTlsTrustBypass={Cfg.EnableTlsTrustBypass}");
         }
         catch (Exception ex)
@@ -665,44 +675,6 @@ public class Mod : MelonMod
         }
     }
 
-    private static string ResolveUserDataDirectory()
-    {
-        foreach (var typeName in new[]
-        {
-            "MelonLoader.MelonEnvironment, MelonLoader",
-            "MelonLoader.MelonUtils, MelonLoader",
-        })
-        {
-            var type = Type.GetType(typeName);
-            var prop = type?.GetProperty("UserDataDirectory", BindingFlags.Public | BindingFlags.Static);
-            if (prop?.GetValue(null) is string value && !string.IsNullOrWhiteSpace(value))
-                return value;
-        }
-
-        var modDll = Assembly.GetExecutingAssembly().Location;
-        var modsDir = Path.GetDirectoryName(modDll) ?? string.Empty;
-        var gameDir = Path.GetDirectoryName(modsDir) ?? AppContext.BaseDirectory;
-        return Path.Combine(gameDir, "MelonLoader", "UserData");
-    }
-
-    private static bool TryGetConfigValue(JsonElement root, string name, out JsonElement value)
-    {
-        if (root.ValueKind == JsonValueKind.Object)
-        {
-            foreach (var prop in root.EnumerateObject())
-            {
-                if (string.Equals(prop.Name, name, StringComparison.OrdinalIgnoreCase))
-                {
-                    value = prop.Value;
-                    return true;
-                }
-            }
-        }
-
-        value = default;
-        return false;
-    }
-
     // ── Patch dispatch helpers ────────────────────────────────────────
     private bool TryPatch(string label, Type target, string methodName,
                           Type[]? args, string? prefix = null, string? postfix = null,

DorkNet.Contracts/DorkNet.Contracts.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Contracts/DorkNetRouteOwnership.cs

@@ -164,15 +164,6 @@ public static class DorkNetRouteOwnership
 
     public static IReadOnlyList<DorkNetRouteGroup> RouteGroups => ServiceRouteGroups;
 
-    public static IReadOnlyList<string> PublicSubdomains =>
-        ServiceRouteGroups
-            .SelectMany(group => group.HostSubdomains)
-            .Append(AdminHost)
-            .Append("feed")
-            .Distinct(StringComparer.OrdinalIgnoreCase)
-            .Order(StringComparer.OrdinalIgnoreCase)
-            .ToArray();
-
     public static bool IsInfrastructurePath(string path)
     {
         return path.Equals("/healthz", StringComparison.OrdinalIgnoreCase)

DorkNet.Gateway/DorkNet.Gateway.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Gateway/Program.cs

@@ -26,20 +26,6 @@ var app = builder.Build();
 
 app.MapDorkNetServiceDefaults();
 
-var publicHosts = BuildPublicHosts(apexDomain);
-app.Use(async (ctx, next) =>
-{
-    if (DorkNetRouteOwnership.IsInfrastructurePath(ctx.Request.Path.Value ?? "/")
-        || IsAllowedPublicHost(ctx.Request.Host.Host, publicHosts))
-    {
-        await next();
-        return;
-    }
-
-    ctx.Response.StatusCode = StatusCodes.Status404NotFound;
-    await ctx.Response.WriteAsync("Unknown DorkNet host.");
-});
-
 app.MapGet("/internal/services", (IOptions<DorkNetServiceMapOptions> options) =>
     Results.Ok(options.Value.Endpoints()));
 app.MapGet("/internal/routes", () =>
@@ -204,33 +190,6 @@ static string[] WebBrowserHosts(string apexDomain)
     return [apexDomain, SubdomainHost("www", apexDomain)];
 }
 
-static HashSet<string> BuildPublicHosts(string apexDomain)
-{
-    var hosts = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
-    {
-        apexDomain,
-        "localhost",
-        "127.0.0.1",
-    };
-
-    foreach (var subdomain in DorkNetRouteOwnership.PublicSubdomains)
-    {
-        hosts.Add(SubdomainHost(subdomain, apexDomain));
-    }
-
-    return hosts;
-}
-
-static bool IsAllowedPublicHost(string? host, HashSet<string> publicHosts)
-{
-    if (string.IsNullOrWhiteSpace(host))
-    {
-        return true;
-    }
-
-    return publicHosts.Contains(host.Split(':', 2)[0].Trim());
-}
-
 static void AddHostRoute(
     List<RouteConfig> routes,
     ref int order,

DorkNet.Models/DorkNet.Models.csproj

@@ -1,7 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
   </PropertyGroup>

DorkNet.Server.Tests/DorkNet.Server.Tests.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>
@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
     <PackageReference Include="xunit" Version="2.9.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />

DorkNet.Server.Tests/DorkNetServerFactory.cs

@@ -1,8 +1,11 @@
+using System.Text;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.HostFiltering;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
 
 namespace DorkNet.Server.Tests;
 
@@ -53,6 +56,18 @@ public sealed class DorkNetServerFactory : WebApplicationFactory<Program>
                 options.AllowEmptyHosts = true;
                 options.IncludeFailureMessage = true;
             });
+            services.PostConfigure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(JwtSecret)),
+                    ValidateIssuer = true,
+                    ValidIssuer = "https://api.rec.net/",
+                    ValidateAudience = false,
+                    ClockSkew = TimeSpan.Zero,
+                };
+            });
         });
     }
 

DorkNet.Server.Tests/GameClientSession.cs

@@ -26,8 +26,6 @@ public static class GameClientSessionFactory
         tokenRequest.Content = new FormUrlEncodedContent(new Dictionary<string, string>
         {
             ["grant_type"] = "password",
-            ["client_id"] = "recroom",
-            ["client_secret"] = "VxZ53kgbbEaRoZAeMe00MagtgD12GLL2",
             ["username"] = "EndpointContract",
             ["device_id"] = deviceId,
             ["platform"] = "0",

DorkNet.Server/Auth/IdentityServerIntegration.cs

@@ -1,590 +0,0 @@
-using System.IdentityModel.Tokens.Jwt;
-using System.Security.Claims;
-using System.Security.Cryptography;
-using System.Security.Cryptography.X509Certificates;
-using System.Text;
-using Open.IdentityServer;
-using Open.IdentityServer.Models;
-using Open.IdentityServer.Services;
-using Open.IdentityServer.Validation;
-using Microsoft.AspNetCore.Http.Features;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Primitives;
-using Microsoft.IdentityModel.Tokens;
-using DorkNet.Server.Data;
-using DorkNet.Server.Data.Entities;
-using DorkNet.Server.Services;
-
-namespace DorkNet.Server.Auth;
-
-public sealed class IdentityServerSigningKeyProvider
-{
-    private readonly string _legacySecret;
-
-    public IdentityServerSigningKeyProvider(IConfiguration config)
-    {
-        _legacySecret =
-            Environment.GetEnvironmentVariable("DORKNET_JWT_SECRET")
-            ?? Environment.GetEnvironmentVariable("RECNET_JWT_SECRET")
-            ?? config["Jwt:Secret"]
-            ?? throw new InvalidOperationException(
-                "JWT secret not configured. Set DORKNET_JWT_SECRET env var or Jwt:Secret in appsettings.Local.json.");
-
-        CertificatePath = ResolveCertificatePath(config);
-        var password = config["IdentityServer:SigningCertificatePassword"] ?? _legacySecret;
-        var certificateBase64 = config["IdentityServer:SigningCertificateBase64"];
-        if (!string.IsNullOrWhiteSpace(certificateBase64))
-        {
-            LoadedFromBase64 = true;
-            Certificate = LoadCertificateFromBase64(certificateBase64, password);
-        }
-        else
-        {
-            Certificate = LoadOrCreateCertificate(CertificatePath, password);
-        }
-        SigningKey = new X509SecurityKey(Certificate);
-        LegacyJwtKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_legacySecret));
-    }
-
-    public string CertificatePath { get; }
-    public bool LoadedFromBase64 { get; }
-    public string CertificateSource => LoadedFromBase64
-        ? "IdentityServer:SigningCertificateBase64"
-        : CertificatePath;
-    public X509Certificate2 Certificate { get; }
-    public SecurityKey SigningKey { get; }
-    public SecurityKey LegacyJwtKey { get; }
-    public SecurityKey[] ValidationKeys => new[] { SigningKey, LegacyJwtKey };
-
-    private static string ResolveCertificatePath(IConfiguration config)
-    {
-        var path = config["IdentityServer:SigningCertificatePath"];
-        if (string.IsNullOrWhiteSpace(path))
-            path = Path.Combine(AppContext.BaseDirectory, "data", "identityserver-signing.pfx");
-        return path;
-    }
-
-    private static X509Certificate2 LoadCertificateFromBase64(string certificateBase64, string password)
-    {
-        var flags = X509KeyStorageFlags.UserKeySet | X509KeyStorageFlags.Exportable;
-        var compact = NormalizeCertificateBase64(certificateBase64);
-        byte[] bytes;
-        try
-        {
-            bytes = Convert.FromBase64String(compact);
-        }
-        catch (FormatException ex)
-        {
-            throw new InvalidOperationException(
-                "IdentityServer signing certificate base64 is invalid. " +
-                "Set IdentityServer__SigningCertificateBase64 to the PFX bytes encoded as base64, " +
-                "without a file path or shell assignment text.",
-                ex);
-        }
-        try
-        {
-            return new X509Certificate2(bytes, password, flags);
-        }
-        catch (CryptographicException ex)
-        {
-            if (TryLoadPemCertificate(bytes, password, flags, out var certificate))
-                return certificate;
-
-            throw new InvalidOperationException(
-                "IdentityServer signing certificate base64 decoded successfully, but it is not a valid PFX/PKCS#12 certificate. " +
-                "Set IdentityServer__SigningCertificateBase64 to the PFX bytes encoded as base64 and make sure " +
-                "IdentityServer__SigningCertificatePassword matches the PFX password.",
-                ex);
-        }
-    }
-
-    private static bool TryLoadPemCertificate(
-        byte[] bytes,
-        string password,
-        X509KeyStorageFlags flags,
-        out X509Certificate2 certificate)
-    {
-        certificate = null!;
-
-        string pem;
-        try
-        {
-            pem = Encoding.UTF8.GetString(bytes);
-        }
-        catch (DecoderFallbackException)
-        {
-            return false;
-        }
-
-        if (!pem.Contains("-----BEGIN", StringComparison.Ordinal))
-            return false;
-
-        try
-        {
-            using var pemCertificate = X509Certificate2.CreateFromPem(pem, pem);
-            if (!pemCertificate.HasPrivateKey)
-                return false;
-
-            var pfxBytes = pemCertificate.Export(X509ContentType.Pfx, password);
-            certificate = new X509Certificate2(pfxBytes, password, flags);
-            return true;
-        }
-        catch (CryptographicException)
-        {
-            return false;
-        }
-    }
-
-    private static string NormalizeCertificateBase64(string value)
-    {
-        var text = value.Trim().Trim('"', '\'');
-        var equals = text.IndexOf('=');
-        if (equals > 0)
-        {
-            var key = text[..equals].Trim();
-            if (key.Equals("IdentityServer__SigningCertificateBase64", StringComparison.OrdinalIgnoreCase) ||
-                key.Equals("IdentityServer:SigningCertificateBase64", StringComparison.OrdinalIgnoreCase))
-                text = text[(equals + 1)..].Trim().Trim('"', '\'');
-        }
-
-        if (text.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
-        {
-            var comma = text.IndexOf(',');
-            if (comma >= 0)
-                text = text[(comma + 1)..];
-        }
-
-        if (text.StartsWith("base64:", StringComparison.OrdinalIgnoreCase))
-            text = text["base64:".Length..];
-
-        var compact = new string(text.Where(c => !char.IsWhiteSpace(c)).ToArray())
-            .Replace('-', '+')
-            .Replace('_', '/');
-        return (compact.Length % 4) switch
-        {
-            2 => compact + "==",
-            3 => compact + "=",
-            _ => compact,
-        };
-    }
-
-    private static X509Certificate2 LoadOrCreateCertificate(string path, string password)
-    {
-        var flags = X509KeyStorageFlags.UserKeySet | X509KeyStorageFlags.Exportable;
-        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
-
-        if (File.Exists(path))
-            return new X509Certificate2(path, password, flags);
-
-        using var rsa = RSA.Create(2048);
-        var request = new CertificateRequest(
-            "CN=DorkNet IdentityServer Signing",
-            rsa,
-            HashAlgorithmName.SHA256,
-            RSASignaturePadding.Pkcs1);
-        request.CertificateExtensions.Add(
-            new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, critical: false));
-
-        using var created = request.CreateSelfSigned(
-            DateTimeOffset.UtcNow.AddDays(-1),
-            DateTimeOffset.UtcNow.AddYears(10));
-        var bytes = created.Export(X509ContentType.Pfx, password);
-        File.WriteAllBytes(path, bytes);
-        return new X509Certificate2(bytes, password, flags);
-    }
-}
-
-public static class RecRoomIdentityServerRegistration
-{
-    public static void AddRecRoomIdentityServer(
-        this IServiceCollection services,
-        IConfiguration config,
-        DomainConfig domain,
-        IdentityServerSigningKeyProvider signingKeyProvider)
-    {
-        services
-            .AddIdentityServer(options =>
-            {
-                options.IssuerUri = domain.AuthIssuer.TrimEnd('/');
-            })
-            .AddInMemoryIdentityResources(RecRoomIdentityServerConfig.IdentityResources)
-            .AddInMemoryApiScopes(RecRoomIdentityServerConfig.ApiScopes)
-            .AddInMemoryClients(RecRoomIdentityServerConfig.Clients)
-            .AddSigningCredential(signingKeyProvider.SigningKey, SecurityAlgorithms.RsaSha256)
-            .AddResourceOwnerValidator<RecRoomPasswordValidator>()
-            .AddExtensionGrantValidator<CachedLoginGrantValidator>()
-            .AddProfileService<RecRoomProfileService>();
-    }
-}
-
-internal static class RecRoomIdentityServerConfig
-{
-    public const string ClientId = "recroom";
-    public const string ClientSecret = "VxZ53kgbbEaRoZAeMe00MagtgD12GLL2";
-    public const string GameClientScope = "gameClient";
-    public const string CachedLoginGrantType = "cached_login";
-
-    public static readonly IdentityResource[] IdentityResources =
-    {
-        new IdentityResources.OpenId(),
-        new IdentityResources.Profile(),
-    };
-
-    public static readonly ApiScope[] ApiScopes =
-    {
-        new(GameClientScope, "Game client")
-        {
-            UserClaims = RecRoomIdentityClaims.UserClaimTypes,
-        },
-        new("api", "DorkNet API")
-        {
-            UserClaims = RecRoomIdentityClaims.UserClaimTypes,
-        },
-    };
-
-    public static readonly Client[] Clients =
-    {
-        new()
-        {
-            ClientId = ClientId,
-            ClientName = "Rec Room game client",
-            RequireClientSecret = true,
-            ClientSecrets = { new Secret(ClientSecret.Sha256()) },
-            AllowedGrantTypes = { GrantType.ResourceOwnerPassword, "refresh_token", CachedLoginGrantType },
-            AllowedScopes = RecRoomScopes(),
-            AllowOfflineAccess = true,
-            AccessTokenLifetime = 60 * 60 * 12,
-            AbsoluteRefreshTokenLifetime = 60 * 60 * 24 * 30,
-            SlidingRefreshTokenLifetime = 60 * 60 * 24 * 30,
-            RefreshTokenUsage = TokenUsage.ReUse,
-            RefreshTokenExpiration = TokenExpiration.Absolute,
-            UpdateAccessTokenClaimsOnRefresh = true,
-            AlwaysIncludeUserClaimsInIdToken = true,
-        },
-    };
-
-    private static ICollection<string> RecRoomScopes() =>
-    [
-        IdentityServerConstants.StandardScopes.OpenId,
-        IdentityServerConstants.StandardScopes.Profile,
-        IdentityServerConstants.StandardScopes.OfflineAccess,
-        GameClientScope,
-        "api",
-    ];
-}
-
-public sealed class IdentityServerGameTokenRequestMiddleware(RequestDelegate next)
-{
-    public async Task InvokeAsync(HttpContext context)
-    {
-        if (!IsTokenRequest(context))
-        {
-            await next(context);
-            return;
-        }
-
-        var form = await context.Request.ReadFormAsync();
-        var values = form.ToDictionary(
-            kvp => kvp.Key,
-            kvp => kvp.Value,
-            StringComparer.OrdinalIgnoreCase);
-        var changed = false;
-
-        if (IsDevicePasswordGrant(values))
-        {
-            if (!values.ContainsKey("username") || string.IsNullOrWhiteSpace(values["username"].ToString()))
-            {
-                values["username"] = First(
-                    values.TryGetValue("deviceId", out var deviceId) ? deviceId.ToString() : null,
-                    values.TryGetValue("device_id", out var deviceIdSnake) ? deviceIdSnake.ToString() : null,
-                    values.TryGetValue("platformId", out var platformId) ? platformId.ToString() : null,
-                    values.TryGetValue("platform_id", out var platformIdSnake) ? platformIdSnake.ToString() : null,
-                    "anonymous");
-                changed = true;
-            }
-
-            if (!values.ContainsKey("password") || string.IsNullOrWhiteSpace(values["password"].ToString()))
-            {
-                values["password"] = "__dorknet_device_login__";
-                values["dorknet_device_login"] = "true";
-                changed = true;
-            }
-        }
-
-        var scopes = values.TryGetValue("scope", out var rawScope)
-            ? rawScope.ToString()
-            : string.Empty;
-        var mergedScopes = MergeScopes(scopes);
-        if (!string.Equals(scopes, mergedScopes, StringComparison.Ordinal))
-        {
-            values["scope"] = mergedScopes;
-            changed = true;
-        }
-
-        if (changed)
-            context.Features.Set<IFormFeature>(new FormFeature(new FormCollection(values)));
-
-        await next(context);
-    }
-
-    private static bool IsTokenRequest(HttpContext context) =>
-        HttpMethods.IsPost(context.Request.Method)
-        && context.Request.Path.Equals("/connect/token", StringComparison.OrdinalIgnoreCase)
-        && context.Request.HasFormContentType;
-
-    private static bool IsDevicePasswordGrant(Dictionary<string, StringValues> values)
-    {
-        if (!values.TryGetValue("grant_type", out var grantType) ||
-            !string.Equals(grantType.ToString(), GrantType.ResourceOwnerPassword, StringComparison.OrdinalIgnoreCase))
-            return false;
-        return !values.TryGetValue("password", out var password) ||
-               string.IsNullOrWhiteSpace(password.ToString());
-    }
-
-    private static string First(params string?[] values) =>
-        values.FirstOrDefault(v => !string.IsNullOrWhiteSpace(v)) ?? "anonymous";
-
-    private static string MergeScopes(string existing)
-    {
-        var scopes = existing
-            .Split(' ', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
-            .ToHashSet(StringComparer.OrdinalIgnoreCase);
-        scopes.Add(IdentityServerConstants.StandardScopes.OpenId);
-        scopes.Add(IdentityServerConstants.StandardScopes.Profile);
-        scopes.Add(IdentityServerConstants.StandardScopes.OfflineAccess);
-        scopes.Add(RecRoomIdentityServerConfig.GameClientScope);
-        return string.Join(' ', scopes);
-    }
-}
-
-public sealed class RecRoomPasswordValidator(
-    PlayerService playerService,
-    LevelService level,
-    ServerSettingsService settings,
-    DorkNetDbContext db,
-    ILogger<RecRoomPasswordValidator> logger) : IResourceOwnerPasswordValidator
-{
-    public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
-    {
-        var raw = context.Request.Raw;
-        var deviceId = First(raw.Get("deviceId"), raw.Get("device_id"));
-        var platformId = First(raw.Get("platformId"), raw.Get("platform_id"));
-        var platform = int.TryParse(raw.Get("platform"), out var p) ? p : 0;
-        var deviceLogin = string.Equals(raw.Get("dorknet_device_login"), "true", StringComparison.OrdinalIgnoreCase);
-
-        if (!deviceLogin && !string.IsNullOrEmpty(context.Password) && !string.IsNullOrEmpty(context.UserName))
-        {
-            var byName = await playerService.GetByUsernameAsync(context.UserName);
-            if (byName is null || byName.PasswordHash is null)
-            {
-                context.Result = new GrantValidationResult(
-                    TokenRequestErrors.InvalidGrant,
-                    "unknown_user_or_no_password");
-                return;
-            }
-
-            if (!BCrypt.Net.BCrypt.Verify(context.Password, byName.PasswordHash))
-            {
-                context.Result = new GrantValidationResult(
-                    TokenRequestErrors.InvalidGrant,
-                    "password_mismatch");
-                return;
-            }
-
-            await playerService.TagPlatformAsync(byName.Id, platform, platformId);
-            await TryAwardLoginXpAsync(byName.Id);
-            context.Result = await CreateSuccessAsync(byName, "password");
-            return;
-        }
-
-        var effectiveDeviceId = !string.IsNullOrWhiteSpace(deviceId)
-            ? deviceId
-            : $"legacy-{(context.UserName ?? "anonymous").ToLowerInvariant()}";
-
-        if (await settings.AreSignupsDisabledAsync())
-        {
-            var existing = await playerService.GetByDeviceAsync(effectiveDeviceId);
-            if (existing is null)
-            {
-                logger.LogInformation(
-                    "[auth] IdentityServer password grant device fallback refused - signups disabled (device={Device})",
-                    effectiveDeviceId);
-                context.Result = new GrantValidationResult(
-                    TokenRequestErrors.InvalidGrant,
-                    "signups_disabled");
-                return;
-            }
-        }
-
-        var player = await playerService.GetOrCreateByDeviceAsync(
-            deviceId: effectiveDeviceId,
-            platform: platform,
-            platformId: platformId,
-            displayName: context.UserName);
-        await TryAwardLoginXpAsync(player.Id);
-        context.Result = await CreateSuccessAsync(player, "device_password");
-    }
-
-    private async Task<GrantValidationResult> CreateSuccessAsync(PlayerEntity player, string authMethod) =>
-        new(
-            subject: player.Id.ToString(),
-            authenticationMethod: authMethod,
-            claims: await RecRoomIdentityClaims.CreateAsync(db, player.Id, player.Username));
-
-    private async Task TryAwardLoginXpAsync(long playerId)
-    {
-        var lastSeen = await db.Players
-            .Where(p => p.Id == playerId)
-            .Select(p => p.LastSeenAt)
-            .FirstOrDefaultAsync();
-        if (lastSeen.Date < DateTime.UtcNow.Date)
-            await level.AwardXpAsync(playerId, LevelService.FirstLoginXp, "first_login_today");
-    }
-
-    private static string? First(params string?[] values) =>
-        values.FirstOrDefault(v => !string.IsNullOrWhiteSpace(v));
-}
-
-public sealed class CachedLoginGrantValidator(
-    PlayerService playerService,
-    LevelService level,
-    OrphanAccountTracker orphans,
-    DorkNetDbContext db,
-    ILogger<CachedLoginGrantValidator> logger) : IExtensionGrantValidator
-{
-    public string GrantType => RecRoomIdentityServerConfig.CachedLoginGrantType;
-
-    public async Task ValidateAsync(ExtensionGrantValidationContext context)
-    {
-        var raw = context.Request.Raw;
-        if (!long.TryParse(raw.Get("account_id"), out var pickedId))
-        {
-            context.Result = new GrantValidationResult(
-                TokenRequestErrors.InvalidGrant,
-                "missing account_id");
-            return;
-        }
-
-        var picked = await playerService.GetByIdAsync(pickedId);
-        if (picked is null)
-        {
-            context.Result = new GrantValidationResult(
-                TokenRequestErrors.InvalidGrant,
-                "unknown account_id");
-            return;
-        }
-
-        var deviceId = First(raw.Get("deviceId"), raw.Get("device_id"));
-        var platformId = First(raw.Get("platformId"), raw.Get("platform_id"));
-        var platform = int.TryParse(raw.Get("platform"), out var p) ? p : 0;
-
-        var pendingId = orphans.PeekPending(deviceId, platformId);
-        if (pendingId is long orphanId && orphanId != pickedId)
-        {
-            await playerService.DeleteOrphanAsync(orphanId);
-            logger.LogInformation(
-                "[orphan-cleanup] cached_login picked {PickedId}; deleted just-created {OrphanId}",
-                pickedId,
-                orphanId);
-        }
-        orphans.Clear(deviceId, platformId);
-
-        await TryAwardLoginXpAsync(picked.Id);
-        await playerService.TagPlatformAsync(picked.Id, platform, platformId);
-        context.Result = new GrantValidationResult(
-            subject: picked.Id.ToString(),
-            authenticationMethod: GrantType,
-            claims: await RecRoomIdentityClaims.CreateAsync(db, picked.Id, picked.Username));
-    }
-
-    private async Task TryAwardLoginXpAsync(long playerId)
-    {
-        var lastSeen = await db.Players
-            .Where(p => p.Id == playerId)
-            .Select(p => p.LastSeenAt)
-            .FirstOrDefaultAsync();
-        if (lastSeen.Date < DateTime.UtcNow.Date)
-            await level.AwardXpAsync(playerId, LevelService.FirstLoginXp, "first_login_today");
-    }
-
-    private static string? First(params string?[] values) =>
-        values.FirstOrDefault(v => !string.IsNullOrWhiteSpace(v));
-}
-
-public sealed class RecRoomProfileService(PlayerService playerService, DorkNetDbContext db) : IProfileService
-{
-    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
-    {
-        if (!TryGetSubjectId(context.Subject, out var playerId))
-            return;
-
-        var player = await playerService.GetByIdAsync(playerId);
-        if (player is null)
-            return;
-
-        context.IssuedClaims.AddRange(
-            await RecRoomIdentityClaims.CreateAsync(db, player.Id, player.Username));
-    }
-
-    public async Task IsActiveAsync(IsActiveContext context)
-    {
-        context.IsActive =
-            TryGetSubjectId(context.Subject, out var playerId)
-            && await playerService.GetByIdAsync(playerId) is not null;
-    }
-
-    private static bool TryGetSubjectId(ClaimsPrincipal subject, out long playerId)
-    {
-        var value = subject.FindFirstValue(JwtRegisteredClaimNames.Sub)
-            ?? subject.FindFirstValue(ClaimTypes.NameIdentifier);
-        return long.TryParse(value, out playerId);
-    }
-}
-
-public static class RecRoomIdentityClaims
-{
-    public static readonly List<string> UserClaimTypes =
-    [
-        JwtRegisteredClaimNames.Sub,
-        ClaimTypes.NameIdentifier,
-        "name",
-        "role",
-        ClaimTypes.Role,
-        "roles",
-        "accountId",
-        "account_id",
-        "accountid",
-    ];
-
-    public static async Task<List<Claim>> CreateAsync(DorkNetDbContext db, long playerId, string? username = null)
-    {
-        var playerInfo = await db.Players
-            .Where(p => p.Id == playerId)
-            .Select(p => new { p.Username, IsDev = p.IsDeveloper || p.IsAdmin })
-            .FirstOrDefaultAsync();
-        var name = username ?? playerInfo?.Username ?? playerId.ToString();
-        var isDev = playerInfo?.IsDev ?? false;
-
-        var claims = new List<Claim>
-        {
-            new(ClaimTypes.NameIdentifier, playerId.ToString()),
-            new(JwtRegisteredClaimNames.Sub, playerId.ToString()),
-            new("name", name),
-            new("accountId", playerId.ToString()),
-            new("account_id", playerId.ToString()),
-            new("accountid", playerId.ToString()),
-            new(ClaimTypes.Role, "gameClient"),
-            new("role", "gameClient"),
-            new("roles", "gameClient"),
-        };
-
-        if (isDev)
-        {
-            claims.Add(new Claim(ClaimTypes.Role, "developer"));
-            claims.Add(new Claim("role", "developer"));
-            claims.Add(new Claim("roles", "developer"));
-        }
-
-        return claims;
-    }
-}

DorkNet.Server/Controllers/API/Config/V1/ServiceUrlsController.cs

@@ -15,5 +15,5 @@ public class ServiceUrlsController(DomainConfig domain) : ControllerBase
 {
     [HttpGet("services")]
     public ActionResult<Dictionary<string, string>> Get()
-        => Ok(ConfigService.BuildServiceUrlMap(domain));
+        => Ok(ConfigService.BuildServiceUrlMap(domain.Apex));
 }

DorkNet.Server/Controllers/API/Notification/V2/NotificationController.cs

@@ -16,7 +16,7 @@ public class NotificationController(DomainConfig domain) : ControllerBase
     public IActionResult Connect() => StatusCode(StatusCodes.Status410Gone, new
     {
         error = "use_signalr_hub",
-        hint = $"connect to {domain.Url("notify", "/hub/v1")} instead",
+        hint = $"connect to {domain.Sub("notify")}/hub/v1 instead",
     });
 
     /// <summary>GET <c>api/notification/hub/v1</c> — returns the
@@ -27,7 +27,7 @@ public class NotificationController(DomainConfig domain) : ControllerBase
     [HttpGet("/api/notification/hub/v1")]
     public IActionResult HubInfo() => Ok(new
     {
-        Url = domain.Url("notify", "/hub/v1"),
+        Url = $"https://{domain.Sub("notify")}/hub/v1",
         Protocol = "signalr",
         Version = 1,
     });

DorkNet.Server/Controllers/Admin/AdminController.cs

@@ -1,7 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.IdentityModel.Tokens;
 using DorkNet.Models.Notification;
 using DorkNet.Server.Auth;
 using DorkNet.Server.Data;
@@ -40,7 +39,6 @@ public class AdminController(
     SignupCodeService signupCodes,
     IObjectStorage storage,
     DomainConfig domain,
-    IdentityServerSigningKeyProvider signingKeys,
     ILogger<AdminController> adminLogger) : ControllerBase
 {
     private long CurrentAdminId => this.RequireCurrentPlayerId();
@@ -1462,52 +1460,6 @@ public class AdminController(
 
     // ── Server settings (runtime toggles) ────────────────────────────────
 
-    [HttpGet("identityserver")]
-    public ActionResult GetIdentityServerSettings()
-    {
-        var issuer = domain.AuthIssuer.TrimEnd('/');
-        var client = RecRoomIdentityServerConfig.Clients[0];
-        var certPath = signingKeys.CertificatePath;
-        var fullCertPath = Path.GetFullPath(certPath);
-        var certificateExists = signingKeys.LoadedFromBase64 || System.IO.File.Exists(fullCertPath);
-
-        return Ok(new
-        {
-            Issuer = issuer,
-            DiscoveryUrl = $"{issuer}/.well-known/openid-configuration",
-            TokenEndpoint = $"{issuer}/connect/token",
-            UserInfoEndpoint = $"{issuer}/connect/userinfo",
-            Client = new
-            {
-                client.ClientId,
-                client.ClientName,
-                AllowedGrantTypes = client.AllowedGrantTypes.ToArray(),
-                AllowedScopes = client.AllowedScopes.ToArray(),
-                client.AllowOfflineAccess,
-                client.AccessTokenLifetime,
-                client.AbsoluteRefreshTokenLifetime,
-                client.SlidingRefreshTokenLifetime,
-                RefreshTokenUsage = client.RefreshTokenUsage.ToString(),
-                RefreshTokenExpiration = client.RefreshTokenExpiration.ToString(),
-            },
-            Signing = new
-            {
-                signingKeys.CertificateSource,
-                signingKeys.LoadedFromBase64,
-                CertificatePath = fullCertPath,
-                CertificateExists = certificateExists,
-                signingKeys.Certificate.Thumbprint,
-                NotBeforeUtc = signingKeys.Certificate.NotBefore.ToUniversalTime(),
-                NotAfterUtc = signingKeys.Certificate.NotAfter.ToUniversalTime(),
-                Algorithm = SecurityAlgorithms.RsaSha256,
-            },
-            PersistedGrants = new
-            {
-                Store = "in-memory",
-                Warning = "Refresh tokens are process-local until an operational store is configured.",
-            },
-        });
-    }
     /// <summary>GET <c>api/admin/v1/settings</c> — current server-wide
     /// toggle state. Single row, single round trip.</summary>
     [HttpGet("settings")]

DorkNet.Server/Controllers/Auth/AuthController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
 using DorkNet.Models.Auth;
 using DorkNet.Server.Data.Entities;
 using DorkNet.Server.Services;
@@ -6,18 +7,241 @@ using DorkNet.Server.Services;
 namespace DorkNet.Server.Controllers.Auth;
 
 /// <summary>
-/// auth.rec.net game-specific auth helpers. OAuth/OIDC endpoints are owned by IdentityServer.
+/// auth.rec.net — OAuth-style token endpoint used by 2019+ builds alongside PlatformLogin.
 /// </summary>
 [ApiController]
 public class AuthController(
     PlayerService playerService,
-    AuthService authService) : ControllerBase
+    AuthService authService,
+    LevelService level,
+    OrphanAccountTracker orphans,
+    ServerSettingsService settings,
+    DorkNet.Server.Data.DorkNetDbContext db,
+    DomainConfig domain,
+    ILogger<AuthController> logger) : ControllerBase
 {
+    /// <summary>Award the per-day first-login XP if the calling
+    /// player hasn't been seen yet today (UTC).</summary>
+    private async Task TryAwardLoginXpAsync(long playerId)
+    {
+        var lastSeen = await db.Players
+            .Where(p => p.Id == playerId)
+            .Select(p => p.LastSeenAt)
+            .FirstOrDefaultAsync();
+        if (lastSeen.Date < DateTime.UtcNow.Date)
+            await level.AwardXpAsync(playerId, LevelService.FirstLoginXp, "first_login_today");
+    }
+    // OAuth token endpoint. The 2020 client uses three grant types here:
+    // - grant_type=cached_login → user clicked a remembered account on the
+    //   account-selection screen. Body includes `account_id` (and platform
+    //   creds). MUST issue a token for THAT specific account; otherwise the
+    //   client receives a JWT for a different account and prompts the user
+    //   to create a new one (because the JWT identity doesn't match what
+    //   they picked).
+    // - grant_type=refresh_token → re-issue access token from the existing
+    //   refresh JWT.
+    // - grant_type=password → first-time sign-in, resolve via deviceId
+    //   (preferred) or fall back to a stable synthetic id derived from
+    //   username so legacy callers don't share accounts.
+    [HttpPost("/connect/token")]
+    [Consumes("application/x-www-form-urlencoded")]
+    public async Task<IActionResult> Token(
+        [FromForm] string? grant_type,
+        [FromForm] string? username,
+        [FromForm] string? password,
+        [FromForm] string? refresh_token,
+        [FromForm] string? deviceId,
+        [FromForm(Name = "device_id")] string? device_id_snake,
+        [FromForm] int platform = 0,
+        [FromForm] string? platformId = null,
+        [FromForm(Name = "platform_id")] string? platform_id_snake = null,
+        [FromForm] long? account_id = null)
+    {
+        // The client mixes camelCase and snake_case parameter naming
+        // depending on grant type — accept both and merge.
+        var effDeviceId = !string.IsNullOrWhiteSpace(deviceId) ? deviceId : device_id_snake;
+        var effPlatformId = !string.IsNullOrWhiteSpace(platformId) ? platformId : platform_id_snake;
+
+        if (string.Equals(grant_type, "cached_login", StringComparison.OrdinalIgnoreCase))
+        {
+            if (account_id is not long pickedId)
+                return BadRequest(new { error = "invalid_request", error_description = "missing account_id" });
+            var picked = await playerService.GetByIdAsync(pickedId);
+            if (picked is null)
+                return Unauthorized(new { error = "invalid_grant", error_description = "unknown account_id" });
+
+            // Orphan cleanup: if the watch just created a brand-new
+            // account on account/create as part of its boot probe, but
+            // the user actually picked a different cached account here,
+            // the just-created row is unused. Delete it so the DB
+            // doesn't accumulate one orphan per game launch. When the
+            // user is genuinely creating a new account, the picked id
+            // matches the just-created id and we leave it.
+            var pendingId = orphans.PeekPending(effDeviceId, effPlatformId);
+            if (pendingId is long orphanId && orphanId != pickedId)
+            {
+                await playerService.DeleteOrphanAsync(orphanId);
+                logger.LogInformation(
+                    "[orphan-cleanup] cached_login picked {PickedId}; deleted just-created {OrphanId}",
+                    pickedId, orphanId);
+            }
+            orphans.Clear(effDeviceId, effPlatformId);
+
+            await TryAwardLoginXpAsync(picked.Id);
+            await playerService.TagPlatformAsync(picked.Id, platform, effPlatformId);
+            var (acc1, refr1) = authService.GenerateTokenPair(picked.Id);
+            return Ok(new
+            {
+                access_token = acc1,
+                token_type = "Bearer",
+                expires_in = 43200,
+                refresh_token = refr1,
+                scope = "openid profile",
+            });
+        }
+
+        if (string.Equals(grant_type, "refresh_token", StringComparison.OrdinalIgnoreCase))
+        {
+            if (string.IsNullOrWhiteSpace(refresh_token))
+                return BadRequest(new { error = "invalid_request" });
+            var resolved = authService.ValidateToken(refresh_token);
+            if (resolved is not long refreshedId)
+                return Unauthorized(new { error = "invalid_grant" });
+            var existing = await playerService.GetByIdAsync(refreshedId);
+            if (existing is null)
+                return Unauthorized(new { error = "invalid_grant" });
+            var (acc, refr) = authService.GenerateTokenPair(existing.Id);
+            return Ok(new
+            {
+                access_token = acc,
+                token_type = "Bearer",
+                expires_in = 43200,
+                refresh_token = refr,
+                scope = "openid profile",
+            });
+        }
+
+        // password grant: two paths.
+        //   • Username + password supplied: real password verify against
+        //     PlayerEntity.PasswordHash. Wrong password → 401.
+        //   • No password: legacy device-id synth path for the 2020
+        //     client's first-launch flow where the player hasn't set a
+        //     password yet (HasPassword returns false in the watch UI
+        //     and prompts them to create one). Resolves the existing
+        //     account (or creates a fresh one) by deviceId.
+        if (!string.IsNullOrEmpty(password) && !string.IsNullOrEmpty(username))
+        {
+            var byName = await playerService.GetByUsernameAsync(username);
+            if (byName is null || byName.PasswordHash is null)
+                return Unauthorized(new
+                {
+                    error = "invalid_grant",
+                    error_description = "unknown_user_or_no_password",
+                });
+            if (!BCrypt.Net.BCrypt.Verify(password, byName.PasswordHash))
+                return Unauthorized(new
+                {
+                    error = "invalid_grant",
+                    error_description = "password_mismatch",
+                });
+            // Tag the platform so the next boot's cached-login lookup
+            // finds this account — without this the watch's "remembered
+            // accounts" prompt would stay empty after a manual sign-in.
+            await playerService.TagPlatformAsync(byName.Id, platform, effPlatformId);
+            await TryAwardLoginXpAsync(byName.Id);
+            var pair = authService.GenerateTokenPair(byName.Id);
+            return Ok(new
+            {
+                access_token = pair.AccessToken,
+                token_type = "Bearer",
+                expires_in = 43200,
+                refresh_token = pair.RefreshToken,
+                scope = "openid profile",
+            });
+        }
+
+        // Device-id fallback path. Prefer the real deviceId; fall back
+        // to a stable legacy synthesis from username so older callers
+        // don't accidentally share an account.
+        var effectiveDeviceId = !string.IsNullOrWhiteSpace(effDeviceId)
+            ? effDeviceId
+            : $"legacy-{(username ?? "anonymous").ToLowerInvariant()}";
+
+        // Honour the admin "signups disabled" toggle. If the device
+        // hasn't logged in before, GetOrCreateByDeviceAsync would mint
+        // a fresh account here — same outcome as hitting
+        // /account/create directly, which the toggle blocks. Refuse
+        // BEFORE creation so the flag isn't bypassable.
+        if (await settings.AreSignupsDisabledAsync())
+        {
+            var existing = await playerService.GetByDeviceAsync(effectiveDeviceId);
+            if (existing is null)
+            {
+                logger.LogInformation(
+                    "[auth] /connect/token device fallback refused — signups disabled (device={Device})",
+                    effectiveDeviceId);
+                return Unauthorized(new
+                {
+                    error = "signups_disabled",
+                    error_description = "Account creation is currently disabled by the server admin.",
+                });
+            }
+        }
+
+        var player = await playerService.GetOrCreateByDeviceAsync(
+            deviceId: effectiveDeviceId,
+            platform: platform,
+            platformId: effPlatformId,
+            displayName: username);
+        await TryAwardLoginXpAsync(player.Id);
+        var (access, refresh) = authService.GenerateTokenPair(player.Id);
+
+        return Ok(new
+        {
+            access_token = access,
+            token_type = "Bearer",
+            expires_in = 43200,
+            refresh_token = refresh,
+            scope = "openid profile",
+        });
+    }
+
+    [HttpGet("/connect/userinfo")]
+    public async Task<IActionResult> UserInfo()
+    {
+        var auth = Request.Headers.Authorization.ToString();
+        if (!auth.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            return Unauthorized();
+        var token = auth["Bearer ".Length..].Trim();
+        var id = authService.ValidateToken(token);
+        if (id is not long playerId) return Unauthorized();
+        var player = await playerService.GetByIdAsync(playerId);
+        if (player is null) return Unauthorized();
+        return Ok(new { sub = player.Id.ToString(), name = player.Username });
+    }
+
+    // Discovery document — issuer + endpoints derived from
+    // DomainConfig so a single DORKNET_DOMAIN env var keeps the
+    // OpenID document pointed at the live deployment.
+    [HttpGet("/.well-known/openid-configuration")]
+    public IActionResult OpenIdConfig()
+    {
+        var base_ = $"https://{domain.Sub("auth")}";
+        return Ok(new
+        {
+            issuer = base_,
+            token_endpoint = $"{base_}/connect/token",
+            userinfo_endpoint = $"{base_}/connect/userinfo",
+        });
+    }
+
     // 2020.12 added an EAC challenge step in the login flow. The client GETs
     // a challenge string and passes it to EACManager.GenerateChallengeResponse,
     // which calls System.Convert.FromBase64CharPtr on the string. So the
-    // returned challenge MUST be valid base64 — sending arbitrary text throws
-    // FormatException client-side and kicks the login.
+    // returned challenge MUST be valid base64 — sending arbitrary text like
+    // "dorknet-eac-disabled" throws FormatException client-side and kicks
+    // the login. 24 chars of base64 'A's decodes to 18 zero bytes; matches
+    // the rough size of a real EAC handshake nonce.
     [HttpGet("/eac/challenge")]
     [HttpPost("/eac/challenge")]
     public IActionResult EacChallenge()
@@ -26,6 +250,11 @@ public class AuthController(
     // Cached-logins lookup — boot-sequence call from ScreenAccountSelectionManager.
     // URL: GET auth.rec.net/cachedlogin/forplatformid/{platform}/{platformId}
     // Returns List<Login.CachedLogin>. Empty array = no remembered accounts.
+    //
+    // Real lookup: any account whose last platformlogin matched
+    // (platform, platformId) shows up here, sorted most-recent-first. On a
+    // single-Steam-emu setup that's one row; on a multi-account dev box
+    // it's the full list the user has cycled through.
     [HttpGet("/cachedlogin/forplatformid/{platform:int}/{platformId}")]
     public async Task<IActionResult> CachedLoginsForPlatform(int platform, string platformId)
     {
@@ -35,8 +264,10 @@ public class AuthController(
 
     /// <summary>POST <c>cachedlogin/forplatformids</c> — bulk variant
     /// the watch uses when hydrating multiple platform-id mappings
-    /// at once. Body is form-urlencoded <c>platform=&amp;platformIds=a,b,c</c>
-    /// or JSON with the same shape.</summary>
+    /// at once (e.g. populating a friend list from Steam ids). Body
+    /// is form-urlencoded <c>platform=&amp;platformIds=a,b,c</c> or
+    /// JSON with the same shape. Returns the flattened
+    /// <c>List&lt;CachedLogin&gt;</c> across every matched id.</summary>
     [HttpPost("/cachedlogin/forplatformids")]
     [HttpGet("/cachedlogin/forplatformids")]
     public async Task<IActionResult> CachedLoginsForPlatformIds()
@@ -54,7 +285,6 @@ public class AuthController(
             }
         }
         catch { /* not form */ }
-
         if (string.IsNullOrWhiteSpace(rawIds))
         {
             int.TryParse(Request.Query["platform"], out platform);
@@ -77,50 +307,13 @@ public class AuthController(
         return Ok(results);
     }
 
-    [HttpGet("/cachedlogin/current")]
-    public async Task<IActionResult> CurrentCachedLogin()
-    {
-        var token = GetBearerToken();
-        if (token is null) return Unauthorized();
-        var id = authService.ValidateToken(token);
-        if (id is not long playerId) return Unauthorized();
-        var player = await playerService.GetByIdAsync(playerId);
-        if (player is null) return Unauthorized();
-        return Ok(ToCachedLogin(player, player.LastPlatform, player.LastPlatformId));
-    }
-
-    [HttpPost("/cachedlogin/migrate")]
-    public async Task<IActionResult> MigrateCachedLogin(
-        [FromForm] int platform = 0,
-        [FromForm] string? platformId = null)
-    {
-        var token = GetBearerToken();
-        if (token is null) return Unauthorized();
-        var id = authService.ValidateToken(token);
-        if (id is not long playerId) return Unauthorized();
-        await playerService.TagPlatformAsync(playerId, platform, platformId);
-        var player = await playerService.GetByIdAsync(playerId);
-        return player is null
-            ? Unauthorized()
-            : Ok(ToCachedLogin(player, platform, platformId ?? string.Empty));
-    }
-
-    private string? GetBearerToken()
-    {
-        var auth = Request.Headers.Authorization.ToString();
-        if (auth.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
-            return auth["Bearer ".Length..].Trim();
-        return Request.Cookies.TryGetValue(AuthService.AccessCookieName, out var cookieToken)
-            ? cookieToken
-            : null;
-    }
-
-    private static CachedLogin ToCachedLogin(PlayerEntity p, int platform, string? platformId) => new()
+    private static CachedLogin ToCachedLogin(PlayerEntity p, int platform, string platformId) => new()
     {
         Platform = platform,
-        PlatformId = platformId ?? string.Empty,
+        PlatformId = platformId,
         AccountId = (int)p.Id,
         LastLoginTime = p.LastSeenAt,
         RequirePassword = false,
     };
+
 }

DorkNet.Server/Controllers/Match/MatchPlayerController.cs

@@ -20,6 +20,7 @@ namespace DorkNet.Server.Controllers.Match;
 [ApiController]
 public class MatchPlayerController(
     PlayerPresenceService presence,
+    NotificationService notifications,
     RoomService rooms,
     PrivateInstanceService privateInstances,
     IConfiguration config,
@@ -36,7 +37,7 @@ public class MatchPlayerController(
     /// </summary>
     [HttpPost("/player/login")]
     [Consumes("application/x-www-form-urlencoded", "multipart/form-data")]
-    public IActionResult PlayerLogin([FromForm(Name = "LoginLock")] string? loginLock)
+    public async Task<IActionResult> PlayerLogin([FromForm(Name = "LoginLock")] string? loginLock)
     {
         var playerId = TryGetCurrentPlayerId();
         if (playerId != 0 && !string.IsNullOrWhiteSpace(loginLock))
@@ -45,15 +46,17 @@ public class MatchPlayerController(
             if (replaced)
             {
                 log.LogWarning(
-                    "[player-login] concurrent session marker replaced for player={PlayerId}; stale SignalR connections will be evicted on hub connect",
+                    "[player-login] concurrent session for player={PlayerId}; kicking old session(s) via ModerationKick push",
                     playerId);
-                // Do not broadcast ModerationKick to the whole player group
-                // here. During reconnects the active watch can already have a
-                // SignalR connection in that group, and the 2020 client crashes
-                // hard if it receives a malformed/stale moderation payload.
-                // NotifyHub.OnConnectedAsync snapshots existing connection ids
-                // before adding the new connection and sends a targeted kick to
-                // those ids only.
+                // The new session hasn't opened its SignalR socket yet
+                // (negotiate fires AFTER /player/login on the watch's
+                // boot sequence — verified in the live trace), so the
+                // ModerationKick push hits only the OLDER session's
+                // existing connections. They'll show the "you've been
+                // kicked" dialog and gracefully disconnect via the
+                // watch's LocalModerationKickSelf path.
+                await notifications.KickStaleSession(playerId,
+                    "Your account was signed in on another device.");
             }
         }
         return Ok(Array.Empty<object>());

DorkNet.Server/Controllers/Ns/NsController.cs

@@ -37,13 +37,13 @@ public class NsController : ControllerBase
     // code: locker)" in BootSequence.
     [HttpGet("/", Order = -1000)]
     public ActionResult<Dictionary<string, string>> Root() =>
-        Ok(ConfigService.BuildServiceUrlMap(_domain));
+        Ok(ConfigService.BuildServiceUrlMap(_domain.Apex));
 
     // Some builds fetch /v1 or /v1/services directly
     [HttpGet("/v1")]
     [HttpGet("/v1/services")]
     public ActionResult<Dictionary<string, string>> Services() =>
-        Ok(ConfigService.BuildServiceUrlMap(_domain));
+        Ok(ConfigService.BuildServiceUrlMap(_domain.Apex));
 
     // Ping / health used by the client keep-alive loop
     [HttpGet("/v1/ping")]

DorkNet.Server/Data/LegacyUpgrades.cs

@@ -180,13 +180,8 @@ public static class LegacyUpgrades
         // either no-op (Crescendo now exists) or the only writer.
         for (var attempt = 1; attempt <= 2; attempt++)
         {
-            var renameCandidates = await db.Rooms
-                .Where(r => r.Name.ToLower() == "bloodmoon" || r.Name.ToLower() == "crescendo")
-                .ToListAsync(ct);
-            var crescendoExists = renameCandidates.Any(r =>
-                string.Equals(r.Name, "Crescendo", StringComparison.OrdinalIgnoreCase));
-            var bloodMoon = renameCandidates.FirstOrDefault(r =>
-                string.Equals(r.Name, "BloodMoon", StringComparison.OrdinalIgnoreCase));
+            var crescendoExists = await db.Rooms.AnyAsync(r => r.Name == "Crescendo", ct);
+            var bloodMoon = await db.Rooms.FirstOrDefaultAsync(r => r.Name == "BloodMoon", ct);
 
             if (bloodMoon is null && crescendoExists)
             {
@@ -222,15 +217,15 @@ public static class LegacyUpgrades
                 {
                     // Both exist — the rename ran on a different row at
                     // some point, and the original BloodMoon row is now
-                    // a stale duplicate. Park it under a unique legacy
-                    // name and hide from browse so /goto/name/... still
+                    // a stale duplicate. Park it under CrescendoLegacy
+                    // and hide from browse so /goto/name/... still
                     // resolves Crescendo to the right row.
-                    bloodMoon.Name = await PickUniqueRoomNameAsync(db, "CrescendoLegacy", bloodMoon.Id, ct);
+                    bloodMoon.Name = "CrescendoLegacy";
                     bloodMoon.HiddenFromBrowse = true;
                     await db.SaveChangesAsync(ct);
                     logger.LogInformation(
-                        "[legacy-upgrade] RenameBloodMoonToCrescendo: applied — Rooms.Id={Id} parked as {Name} (Crescendo already existed on a different row)",
-                        bloodMoon.Id, bloodMoon.Name);
+                        "[legacy-upgrade] RenameBloodMoonToCrescendo: applied — Rooms.Id={Id} parked as CrescendoLegacy (Crescendo already existed on a different row)",
+                        bloodMoon.Id);
                     return;
                 }
             }
@@ -246,22 +241,4 @@ public static class LegacyUpgrades
             }
         }
     }
-
-    private static async Task<string> PickUniqueRoomNameAsync(
-        DorkNetDbContext db, string preferred, long currentRoomId, CancellationToken ct)
-    {
-        var taken = await db.Rooms
-            .Where(r => r.Id != currentRoomId && r.Name.ToLower().StartsWith(preferred.ToLower()))
-            .Select(r => r.Name)
-            .ToListAsync(ct);
-
-        if (!taken.Any(n => string.Equals(n, preferred, StringComparison.OrdinalIgnoreCase)))
-            return preferred;
-
-        var suffix = 2;
-        while (taken.Any(n => string.Equals(n, $"{preferred}{suffix}", StringComparison.OrdinalIgnoreCase)))
-            suffix++;
-
-        return $"{preferred}{suffix}";
-    }
 }

DorkNet.Server/DorkNet.Server.csproj

@@ -1,22 +1,20 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Open.IdentityServer" Version="1.0.0" />
-    <PackageReference Include="MessagePack" Version="3.1.7" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.4" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.15" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.4">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
     <!-- RenderedCompactJsonFormatter for stdout JSON logs in production
          (Coolify-friendly). The host pipeline reads stdout line-by-line,
          and structured JSON lets a future Loki/Datadog ingest parse fields
@@ -27,8 +25,8 @@
          scale: SignalR group fanout, OrphanAccountTracker (sticky-session
          account-creation flow), and PlayerPresenceService heartbeats all
          need shared state across replicas. -->
-    <PackageReference Include="StackExchange.Redis" Version="2.13.17" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.9" />
+    <PackageReference Include="StackExchange.Redis" Version="2.8.16" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="9.0.4" />
     <!-- S3-compatible object storage. Production target: Garage in
          Coolify (one-click). Dev fallback: local MinIO for parity
          testing. The SDK speaks plain S3, so swapping endpoints
@@ -40,7 +38,7 @@
          cost+salt in the output string so we only need one column. -->
     <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.3" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="7.3.1" />
     <!-- Server-side crop/resize for img.* CDN transforms (?cropSquare=1&width=N
          on profile thumbnails). The 2020 client treats this as part of the
          image CDN contract — it uploads a full-frame capture and expects the
@@ -75,7 +73,6 @@
 
   <ItemGroup>
     <ProjectReference Include="..\DorkNet.Models\DorkNet.Models.csproj" />
-    <ProjectReference Include="..\DorkNet.Contracts\DorkNet.Contracts.csproj" />
   </ItemGroup>
 
   <!-- Service-slice containers reference DorkNet.Server for shared controllers

DorkNet.Server/Services/AuthService.cs

@@ -3,16 +3,12 @@ using Microsoft.IdentityModel.Tokens;
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
 using System.Text;
-using DorkNet.Server.Auth;
 using DorkNet.Server.Data;
 
 namespace DorkNet.Server.Services;
 
-public class AuthService(IConfiguration config, DorkNetDbContext db, DomainConfig domain, IdentityServerSigningKeyProvider signingKeyProvider)
+public class AuthService(IConfiguration config, DorkNetDbContext db)
 {
-    public const string AccessCookieName = "dorknet_access_token";
-    public const string LegacyIssuer = "https://api.rec.net/";
-
     // Resolution order MUST match Program.cs's JwtBearer validator setup —
     // env var first, config key second — otherwise tokens are signed with
     // one secret and validated against another and every authenticated
@@ -42,17 +38,38 @@ public class AuthService(IConfiguration config, DorkNetDbContext db, DomainConfi
     private string CreateJwt(long playerId, TimeSpan lifetime, string tokenType)
     {
         var handler = new JwtSecurityTokenHandler();
-        var claims = RecRoomIdentityClaims.CreateAsync(db, playerId)
-            .GetAwaiter()
-            .GetResult();
-        claims.Add(new Claim("token_type", tokenType));
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey));
+
+        // Look up dev/admin flags so the JWT carries a "developer" role
+        // claim for accounts that should see the in-game debug button.
+        // The watch's Login.SetAccessToken parses the access_token's
+        // <c>role</c> claim — either a single string or a list — and
+        // calls <c>HasRole("developer", token)</c>; that result drives
+        // <c>Accounts.SetLocalAccountIsDev</c> and ultimately
+        // <c>SessionManager.IsDeveloper</c>, which the watch UI checks
+        // when deciding whether to show the dev console toggle.
+        var isDev = db.Players
+            .Where(p => p.Id == playerId)
+            .Select(p => (bool?)(p.IsDeveloper || p.IsAdmin))
+            .FirstOrDefault() ?? false;
+
+        var claims = new List<Claim>
+        {
+            new(ClaimTypes.NameIdentifier, playerId.ToString()),
+            new(ClaimTypes.Role, "gameClient"),
+            new("token_type", tokenType),
+        };
+        // Multiple Role claims become a JSON array on the wire — the
+        // watch's HasRole helper handles both string and List<string>
+        // forms.
+        if (isDev) claims.Add(new Claim(ClaimTypes.Role, "developer"));
 
         var descriptor = new SecurityTokenDescriptor
         {
             Subject = new ClaimsIdentity(claims),
             Expires = DateTime.UtcNow.Add(lifetime),
-            Issuer = domain.AuthIssuer,
-            SigningCredentials = new SigningCredentials(signingKeyProvider.SigningKey, SecurityAlgorithms.RsaSha256),
+            Issuer = "https://api.rec.net/",
+            SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256),
         };
 
         return handler.WriteToken(handler.CreateJwtSecurityToken(descriptor));
@@ -63,22 +80,19 @@ public class AuthService(IConfiguration config, DorkNetDbContext db, DomainConfi
         try
         {
             var handler = new JwtSecurityTokenHandler();
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey));
+
             var principal = handler.ValidateToken(token, new TokenValidationParameters
             {
                 ValidateIssuerSigningKey = true,
-                IssuerSigningKeys = signingKeyProvider.ValidationKeys,
+                IssuerSigningKey = key,
                 ValidateIssuer = true,
-                ValidIssuers = new[] { domain.AuthIssuer, LegacyIssuer },
+                ValidIssuer = "https://api.rec.net/",
                 ValidateAudience = false,
                 ClockSkew = TimeSpan.Zero,
             }, out _);
 
-            var idClaim = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value
-                ?? principal.FindFirst(JwtRegisteredClaimNames.Sub)?.Value
-                ?? principal.FindFirst("sub")?.Value
-                ?? principal.FindFirst("accountId")?.Value
-                ?? principal.FindFirst("account_id")?.Value
-                ?? principal.FindFirst("accountid")?.Value;
+            var idClaim = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
             return idClaim is not null ? long.Parse(idClaim) : null;
         }
         catch

DorkNet.Server/Services/ConfigService.cs

@@ -25,9 +25,9 @@ public class ConfigService(IConfiguration config, DomainConfig domain)
         return new RecRoomConfig
         {
             MessageOfTheDay = config["Server:MOTD"] ?? "Welcome to the private server!",
-            CdnBaseUri = domain.Url("cdn"),
+            CdnBaseUri = $"https://{domain.Sub("cdn")}",
             PhotonConfig = photon,
-            ServiceUrls = BuildServiceUrlMap(domain),
+            ServiceUrls = BuildServiceUrlMap(apex),
             ConfigTable = new Dictionary<string, string>
             {
                 // Season keys the 2019/2020 client checks at startup
@@ -110,14 +110,12 @@ public class ConfigService(IConfiguration config, DomainConfig domain)
     /// <see cref="DomainConfig.Apex"/>) so the map stays a single
     /// source of truth.</summary>
     public static Dictionary<string, string> BuildServiceUrlMap(string apex)
-        => BuildServiceUrlMap(new DomainConfig(apex));
-
-    public static Dictionary<string, string> BuildServiceUrlMap(DomainConfig domain)
     {
         var map = new Dictionary<string, string>(ServiceSubdomains.Length);
         foreach (var (service, sub) in ServiceSubdomains)
         {
-            map[service] = domain.Url(sub);
+            var host = string.IsNullOrEmpty(sub) ? apex : $"{sub}.{apex}";
+            map[service] = $"https://{host}";
         }
         return map;
     }

DorkNet.Server/Services/DomainConfig.cs

@@ -11,31 +11,8 @@ namespace DorkNet.Server.Services;
 public sealed class DomainConfig
 {
     public string Apex { get; }
-    public string Scheme { get; }
-
-    public DomainConfig(string apex, string scheme = "https")
-    {
-        Apex = apex;
-        Scheme = NormalizeScheme(scheme);
-    }
-
+    public DomainConfig(string apex) { Apex = apex; }
     public string Sub(string prefix) => $"{prefix}.{Apex}";
-
-    public string AuthIssuer => Url("auth");
-
-    public string Url(string prefix, string path = "")
-    {
-        var host = string.IsNullOrEmpty(prefix) ? Apex : Sub(prefix);
-        if (string.IsNullOrEmpty(path)) return $"{Scheme}://{host}";
-        return $"{Scheme}://{host}{(path.StartsWith('/') ? path : "/" + path)}";
-    }
-
     public static bool MatchesSubdomain(string host, string prefix)
         => host.StartsWith(prefix + ".", StringComparison.OrdinalIgnoreCase);
-
-    private static string NormalizeScheme(string? value)
-    {
-        var scheme = string.IsNullOrWhiteSpace(value) ? "https" : value.Trim().TrimEnd(':', '/', '\\').ToLowerInvariant();
-        return scheme is "http" or "https" ? scheme : "https";
-    }
 }

DorkNet.Server/Services/GameSessionService.cs

@@ -64,12 +64,7 @@ public class GameSessionService(DorkNetDbContext db)
             // in, so we save once with a placeholder, then patch and save
             // again. Two SaveChangesAsync calls is cheap at our QPS.
             PhotonRoomName = "pending",
-            // Track the room's "Max Player Count in This Subroom" slider
-            // instead of a hardcoded 8, so matchmade joiners fill the room to
-            // the host's chosen limit rather than fragmenting into a new
-            // instance every 8 players. (Existing sessions keep whatever cap
-            // they were created with.)
-            MaxCapacity = await ResolveRoomMaxCapacityAsync(effectiveRoom),
+            MaxCapacity = 8,
             PlayerCount = 1,
             CreatedAt = DateTime.UtcNow,
         };
@@ -80,28 +75,6 @@ public class GameSessionService(DorkNetDbContext db)
         return ToDto(session);
     }
 
-    // Default session cap when we can't resolve a room-specific value (system
-    // rooms like the dorm use a GUID roomId that doesn't map to a RoomEntity).
-    private const int DefaultMaxCapacity = 8;
-
-    /// <summary>Resolve a new session's capacity from the room's entry
-    /// subroom (lowest <c>OrderIndex</c>) <see cref="RoomSceneEntity.MaxPlayers"/>
-    /// — the value the in-game "Max Player Count in This Subroom" slider
-    /// writes. Matchmade sessions land in the entry subroom, so its cap is the
-    /// right ceiling. GameSession roomIds are the room's numeric Id as a
-    /// string for user rooms; non-numeric (dorm GUID, etc.) → default. Clamped
-    /// to a sane Photon ceiling.</summary>
-    private async Task<int> ResolveRoomMaxCapacityAsync(string roomId)
-    {
-        if (!long.TryParse(roomId, out var roomLongId)) return DefaultMaxCapacity;
-        var max = await db.RoomScenes
-            .Where(s => s.RoomId == roomLongId)
-            .OrderBy(s => s.OrderIndex)
-            .Select(s => (int?)s.MaxPlayers)
-            .FirstOrDefaultAsync();
-        return max is int v && v > 0 ? Math.Clamp(v, 1, 80) : DefaultMaxCapacity;
-    }
-
     public async Task<GameSession?> GetByIdAsync(long id)
     {
         var s = await db.GameSessions.AsNoTracking()

DorkNet.Server/Startup/MiddlewarePipelineExtensions.cs

@@ -70,7 +70,7 @@ public static class MiddlewarePipelineExtensions
             if (ctx.Request.Host.Host.Equals(domainCfg.Sub("api"), StringComparison.OrdinalIgnoreCase) &&
                 (ctx.Request.Path == "/admin" || ctx.Request.Path.StartsWithSegments("/admin")))
             {
-                ctx.Response.Redirect(domainCfg.Url("admin", "/"), permanent: false);
+                ctx.Response.Redirect($"https://{domainCfg.Sub("admin")}/", permanent: false);
                 return;
             }
             await next();
@@ -87,9 +87,6 @@ public static class MiddlewarePipelineExtensions
         // calls (login, photon custom auth) are gated too.
         app.UseMiddleware<VersionDetectionMiddleware>();
 
-        app.UseMiddleware<IdentityServerGameTokenRequestMiddleware>();
-        app.UseIdentityServer();
-
         app.UseAuthentication();
         app.UseAuthorization();
         // Sits between auth and the controllers — by this point ctx.User has

DorkNet.Server/Startup/ServiceCollectionExtensions.cs

@@ -1,8 +1,6 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
-using DorkNet.Contracts;
-using DorkNet.Server.Auth;
 using DorkNet.Server.Compat;
 using DorkNet.Server.Data;
 using DorkNet.Server.Services;
@@ -25,11 +23,11 @@ public static class ServiceCollectionExtensions
     {
         ConfigureLogging(builder);
         AddDatabase(builder);
-        var domain = AddDomain(builder);
+        AddDomain(builder);
         AddCoreServices(builder.Services);
         AddVersionCompatibility(builder);
         var redisConn = AddRedis(builder);
-        AddAuthentication(builder, domain);
+        AddAuthentication(builder);
         AddKestrelAndSignalR(builder, redisConn);
     }
 
@@ -102,27 +100,20 @@ public static class ServiceCollectionExtensions
     // Replaces per-controller [Host(...)] filters that hard-coded
     // rec.net/localhost pairs — the singleton DomainConfig is injected
     // anywhere code needs to build outbound URLs.
-    private static DomainConfig AddDomain(WebApplicationBuilder builder)
+    private static void AddDomain(WebApplicationBuilder builder)
     {
         var apex =
             builder.Configuration["Domain:Apex"]
             ?? Environment.GetEnvironmentVariable("DORKNET_DOMAIN")
             ?? "localhost";
-        var scheme = builder.Configuration["Domain:Scheme"] ?? "https";
-        var domain = new DomainConfig(apex, scheme);
-        builder.Services.AddSingleton(domain);
-        var allowedHosts = new[] { apex, "localhost", "127.0.0.1" }
-            .Concat(DorkNetRouteOwnership.PublicSubdomains.Select(subdomain => $"{subdomain}.{apex}"))
-            .Distinct(StringComparer.OrdinalIgnoreCase)
-            .ToArray();
+        builder.Services.AddSingleton(new DomainConfig(apex));
         builder.Services.Configure<Microsoft.AspNetCore.HostFiltering.HostFilteringOptions>(opt =>
         {
-            opt.AllowedHosts = allowedHosts;
+            opt.AllowedHosts = new[] { apex, $"*.{apex}", "localhost", "127.0.0.1" };
             opt.AllowEmptyHosts = true;
             opt.IncludeFailureMessage = true;
         });
-        Console.WriteLine($"[domain] apex={apex}, allowedHosts=[{string.Join(", ", allowedHosts)}]");
-        return domain;
+        Console.WriteLine($"[domain] apex={apex}, allowedHosts=[{apex}, *.{apex}, localhost]");
     }
 
     // ── Services ──────────────────────────────────────────────────────────────
@@ -255,11 +246,15 @@ public static class ServiceCollectionExtensions
     // Never commit a real secret to appsettings.json. DORKNET_JWT_SECRET is the
     // canonical env var name; RECNET_JWT_SECRET kept for backward compat with
     // older Coolify configs.
-    private static void AddAuthentication(WebApplicationBuilder builder, DomainConfig domain)
+    private static void AddAuthentication(WebApplicationBuilder builder)
     {
-        var signingKeyProvider = new IdentityServerSigningKeyProvider(builder.Configuration);
-        builder.Services.AddSingleton(signingKeyProvider);
-        builder.Services.AddRecRoomIdentityServer(builder.Configuration, domain, signingKeyProvider);
+        var jwtSecret = Environment.GetEnvironmentVariable("DORKNET_JWT_SECRET")
+            ?? Environment.GetEnvironmentVariable("RECNET_JWT_SECRET")
+            ?? builder.Configuration["Jwt:Secret"]
+            ?? throw new InvalidOperationException(
+                "JWT secret not configured. Set the DORKNET_JWT_SECRET env var or " +
+                "add `Jwt:Secret` to appsettings.Local.json (the install-plugin.ps1 " +
+                "script generates one automatically on same-machine setup).");
 
         builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             .AddJwtBearer(opt =>
@@ -267,9 +262,9 @@ public static class ServiceCollectionExtensions
                 opt.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateIssuerSigningKey = true,
-                    IssuerSigningKeys = signingKeyProvider.ValidationKeys,
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSecret)),
                     ValidateIssuer = true,
-                    ValidIssuers = new[] { domain.AuthIssuer, AuthService.LegacyIssuer },
+                    ValidIssuer = "https://api.rec.net/",
                     ValidateAudience = false,
                     ClockSkew = TimeSpan.Zero,
                 };
@@ -289,12 +284,6 @@ public static class ServiceCollectionExtensions
                         var path = ctx.HttpContext.Request.Path;
                         if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/hub"))
                             ctx.Token = accessToken;
-                        if (string.IsNullOrEmpty(ctx.Token) &&
-                            ctx.Request.Cookies.TryGetValue(AuthService.AccessCookieName, out var cookieToken) &&
-                            !string.IsNullOrWhiteSpace(cookieToken))
-                        {
-                            ctx.Token = cookieToken;
-                        }
                         return Task.CompletedTask;
                     },
                 };

DorkNet.Server/admin-ui/src/pages/IdentityServer.tsx

@@ -1,209 +0,0 @@
-import { useEffect, useState } from 'react';
-import { get } from '../lib/api';
-import { RefreshCw } from '../components/Icons';
-
-interface IdentityServerSettings {
-  issuer: string;
-  discoveryUrl: string;
-  tokenEndpoint: string;
-  userInfoEndpoint: string;
-  client: {
-    clientId: string;
-    clientName: string;
-    allowedGrantTypes: string[];
-    allowedScopes: string[];
-    allowOfflineAccess: boolean;
-    accessTokenLifetime: number;
-    absoluteRefreshTokenLifetime: number;
-    slidingRefreshTokenLifetime: number;
-    refreshTokenUsage: string;
-    refreshTokenExpiration: string;
-  };
-  signing: {
-    certificateSource: string;
-    loadedFromBase64: boolean;
-    certificatePath: string;
-    certificateExists: boolean;
-    thumbprint: string;
-    notBeforeUtc: string;
-    notAfterUtc: string;
-    algorithm: string;
-  };
-  persistedGrants: {
-    store: string;
-    warning: string;
-  };
-}
-
-export function IdentityServer() {
-  const [settings, setSettings] = useState<IdentityServerSettings | null>(null);
-  const [err, setErr] = useState<string | null>(null);
-  const [busy, setBusy] = useState(false);
-
-  const load = async () => {
-    setBusy(true);
-    try {
-      const data = await get<IdentityServerSettings>('/identityserver');
-      setSettings(data);
-      setErr(null);
-    } catch (e) {
-      setErr((e as Error).message);
-    } finally {
-      setBusy(false);
-    }
-  };
-
-  useEffect(() => { void load(); }, []);
-
-  return (
-    <div>
-      <div className="mb-3 flex justify-end">
-        <button onClick={load} className="btn-secondary text-xs" disabled={busy}>
-          <RefreshCw className={busy ? 'animate-spin' : ''} />
-          Refresh
-        </button>
-      </div>
-
-      {err && (
-        <div className="card border-danger/30 bg-danger/5 px-4 py-3 text-sm text-danger mb-4">{err}</div>
-      )}
-
-      {!settings && !err && (
-        <div className="card !p-6 text-center text-xs text-ink-400">Loading...</div>
-      )}
-
-      {settings && (
-        <div className="grid gap-5 xl:grid-cols-[minmax(0,1fr)_360px]">
-          <div className="space-y-5">
-            <div className="card !p-5">
-              <div className="flex flex-wrap items-start justify-between gap-4">
-                <div>
-                  <h2 className="text-sm font-semibold text-ink-50">IdentityServer</h2>
-                  <p className="mt-1 break-all font-mono text-xs text-ink-300">{settings.issuer}</p>
-                </div>
-                <div className="flex flex-wrap gap-2 text-xs">
-                  <StatusBadge ok={settings.signing.certificateExists} on="Signing key" off="Missing key" />
-                </div>
-              </div>
-
-              <div className="mt-5 grid gap-3 md:grid-cols-3">
-                <Endpoint label="Discovery" value={settings.discoveryUrl} />
-                <Endpoint label="Token" value={settings.tokenEndpoint} />
-                <Endpoint label="UserInfo" value={settings.userInfoEndpoint} />
-              </div>
-            </div>
-
-            <div className="card !p-5">
-              <div className="mb-4 flex flex-wrap items-center justify-between gap-3">
-                <div>
-                  <h2 className="text-sm font-semibold text-ink-50">Client</h2>
-                  <p className="mt-1 font-mono text-xs text-ink-400">{settings.client.clientId}</p>
-                </div>
-                <span className={settings.client.allowOfflineAccess ? 'badge-online' : 'badge-neutral'}>
-                  Offline access {settings.client.allowOfflineAccess ? 'on' : 'off'}
-                </span>
-              </div>
-
-              <div className="grid gap-4 lg:grid-cols-2">
-                <ChipList title="Grant types" values={settings.client.allowedGrantTypes} />
-                <ChipList title="Scopes" values={settings.client.allowedScopes} />
-              </div>
-
-              <div className="mt-5 grid gap-3 sm:grid-cols-3">
-                <Metric label="Access token" value={duration(settings.client.accessTokenLifetime)} />
-                <Metric label="Refresh token" value={duration(settings.client.absoluteRefreshTokenLifetime)} />
-                <Metric label="Refresh mode" value={`${settings.client.refreshTokenUsage} / ${settings.client.refreshTokenExpiration}`} />
-              </div>
-            </div>
-
-          </div>
-
-          <div className="space-y-5">
-            <div className="card !p-5">
-              <h2 className="text-sm font-semibold text-ink-50">Signing certificate</h2>
-              <div className="mt-4 space-y-3">
-                <Detail label="Source" value={settings.signing.certificateSource} mono />
-                {!settings.signing.loadedFromBase64 && (
-                  <Detail label="Path" value={settings.signing.certificatePath} mono />
-                )}
-                <Detail label="Thumbprint" value={settings.signing.thumbprint} mono />
-                <Detail label="Algorithm" value={settings.signing.algorithm} mono />
-                <Detail label="Valid from" value={formatDate(settings.signing.notBeforeUtc)} />
-                <Detail label="Valid until" value={formatDate(settings.signing.notAfterUtc)} />
-              </div>
-            </div>
-
-            <div className="card !p-5">
-              <h2 className="text-sm font-semibold text-ink-50">Operational store</h2>
-              <div className="mt-3 flex items-center justify-between gap-3">
-                <span className="text-xs text-ink-400">Persisted grants</span>
-                <span className="badge-junior">{settings.persistedGrants.store}</span>
-              </div>
-              <p className="mt-4 text-xs leading-5 text-ink-400">{settings.persistedGrants.warning}</p>
-            </div>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
-function Endpoint({ label, value }: { label: string; value: string }) {
-  return (
-    <div className="rounded-lg border border-ink-800 bg-ink-950/40 p-3">
-      <div className="label">{label}</div>
-      <div className="mt-2 break-all font-mono text-xs text-ink-100">{value}</div>
-    </div>
-  );
-}
-
-function ChipList({ title, values }: { title: string; values: string[] }) {
-  return (
-    <div className="rounded-lg border border-ink-800 bg-ink-950/30 p-4">
-      <h3 className="text-xs font-semibold uppercase text-ink-400">{title}</h3>
-      <div className="mt-3 flex flex-wrap gap-2">
-        {values.map((value) => (
-          <span key={value} className="badge-neutral font-mono normal-case tracking-normal">{value}</span>
-        ))}
-      </div>
-    </div>
-  );
-}
-
-function Metric({ label, value }: { label: string; value: string }) {
-  return (
-    <div className="rounded-lg border border-ink-800 bg-ink-950/30 p-3">
-      <div className="text-[11px] uppercase text-ink-500">{label}</div>
-      <div className="mt-1 text-sm font-semibold text-ink-50">{value}</div>
-    </div>
-  );
-}
-
-function Detail({ label, value, mono }: { label: string; value: string; mono?: boolean }) {
-  return (
-    <div>
-      <div className="label">{label}</div>
-      <div className={(mono ? 'font-mono ' : '') + 'mt-1 break-all text-xs text-ink-100'}>{value}</div>
-    </div>
-  );
-}
-
-function StatusBadge({ ok, on, off }: { ok: boolean; on: string; off: string }) {
-  return <span className={ok ? 'badge-online' : 'badge-junior'}>{ok ? on : off}</span>;
-}
-
-function formatDate(value: string): string {
-  const date = new Date(value);
-  return Number.isNaN(date.getTime()) ? value : date.toLocaleString();
-}
-
-function duration(seconds: number): string {
-  if (!Number.isFinite(seconds) || seconds <= 0) return '0s';
-  const days = Math.floor(seconds / 86400);
-  const hours = Math.floor((seconds % 86400) / 3600);
-  const minutes = Math.floor((seconds % 3600) / 60);
-  if (days > 0) return `${days}d ${hours}h`;
-  if (hours > 0) return `${hours}h ${minutes}m`;
-  if (minutes > 0) return `${minutes}m`;
-  return `${seconds}s`;
-}

DorkNet.Server/admin-ui/src/pages/SettingsHome.tsx

@@ -1,5 +1,4 @@
 import { Settings } from './Settings';
-import { IdentityServer } from './IdentityServer';
 import { SignupCodes } from './SignupCodes';
 import { PageHeader } from '../components/PageHeader';
 import { Tabs, useTabParam } from '../components/Tabs';
@@ -8,21 +7,19 @@ import { Tabs, useTabParam } from '../components/Tabs';
 // invite codes (an access-control setting in its own right). Old
 // /signup-codes route redirects here with ?tab=signup.
 export function SettingsHome() {
-  const [tab, setTab] = useTabParam<'server' | 'identity' | 'signup'>('server', ['server', 'identity', 'signup']);
+  const [tab, setTab] = useTabParam<'server' | 'signup'>('server', ['server', 'signup']);
   return (
     <div>
-      <PageHeader title="Settings" blurb="Runtime server toggles, authentication, and single-use signup invite codes." />
+      <PageHeader title="Settings" blurb="Runtime server toggles and single-use signup invite codes." />
       <Tabs
         tabs={[
           { key: 'server', label: 'Server' },
-          { key: 'identity', label: 'IdentityServer' },
           { key: 'signup', label: 'Signup codes' },
         ]}
         active={tab}
         onChange={setTab}
       />
       {tab === 'server' && <Settings embedded />}
-      {tab === 'identity' && <IdentityServer />}
       {tab === 'signup' && <SignupCodes embedded />}
     </div>
   );

DorkNet.ServiceDefaults/DorkNet.ServiceDefaults.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Commerce/DorkNet.Services.Commerce.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Content/DorkNet.Services.Content.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Identity/DorkNet.Services.Identity.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Moderation/DorkNet.Services.Moderation.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Notify/DorkNet.Services.Notify.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Platform/DorkNet.Services.Platform.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Rooms/DorkNet.Services.Rooms.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Social/DorkNet.Services.Social.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Web/DorkNet.Services.Web.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

README.md

@@ -72,17 +72,13 @@ cd DorkNet
 | `S3:SecretKey` | `S3__SecretKey` | production | S3 secret key |
 | `S3:Region` | `S3__Region` | no | defaults to `garage`; use `auto` for R2 |
 
-`/connect/token` issues access and refresh tokens with the configured
-auth host as the issuer. Set `DORKNET_DOMAIN` for production so OpenID
-discovery and JWT validation agree on `https://auth.<domain>`.
-
 **4. Boot a local standalone server:**
 
 ```pwsh
 dotnet run --project DorkNet.Server
 ```
 
-First boot creates `bin/Debug/net10.0/data/dorknet.db`, runs every
+First boot creates `bin/Debug/net9.0/data/dorknet.db`, runs every
 `LegacyUpgrades` pass, seeds canonical rooms / store catalog / club
 categories / playlists, and starts listening. You should see
 `Application started.` in the log; `curl http://localhost:8080/healthz`

docker-compose.microservices.dokploy.yml

@@ -17,9 +17,8 @@ x-dorknet-service-env: &dorknet-service-env
 
 x-dorknet-app-networks: &dorknet-app-networks
   networks:
-    # Internal only — backends are reached by the gateway over `default`,
-    # never directly by Traefik, so keep them off dokploy-network.
     - default
+    - dokploy-network
 
 services:
   gateway:
@@ -43,18 +42,6 @@ services:
       DorkNet__Services__Monolith: http://monolith:8080
     expose:
       - "8080"
-    networks:
-      - default
-      - dokploy-network
-    labels:
-      # Cloudflare terminates TLS at the edge; the tunnel -> Traefik leg is
-      # internal HTTP, so route on the `web` entrypoint with no certresolver.
-      - traefik.enable=true
-      - traefik.docker.network=dokploy-network
-      # Scope routing to YOUR domain (apex + subdomains) instead of catch-all:
-      - traefik.http.routers.dorknet-gw.rule=Host(`${DORKNET_DOMAIN}`) || HostRegexp(`^.+\.${DORKNET_DOMAIN}$`)
-      - traefik.http.routers.dorknet-gw.entrypoints=web
-      - traefik.http.services.dorknet-gw.loadbalancer.server.port=8080
     depends_on:
       - identity
       - rooms
@@ -70,10 +57,6 @@ services:
   cloudflared:
     image: cloudflare/cloudflared:latest
     command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN:?Set CLOUDFLARE_TUNNEL_TOKEN in Dokploy}
-    # Must share dokploy-network so the tunnel can reach the Traefik
-    # container (dokploy-traefik) by name and hand traffic off to it.
-    networks:
-      - dokploy-network
     depends_on:
       - gateway
     restart: unless-stopped

docs/architecture.md

@@ -38,7 +38,7 @@ DorkNet.sln
 | `DorkNet.Contracts` | Service names, route ownership, service-map options, health responses, probe responses | .NET 9 |
 | `DorkNet.ServiceDefaults` | Common service health checks, JSON defaults, HTTP clients, service identity, route guard | .NET 9 |
 | `DorkNet.Gateway` | Edge reverse proxy; routes host/path slices to services and exposes service health probes | .NET 9 |
-| `DorkNet.Services.Identity` | Accounts, auth, platform login, OpenID discovery, JWT issuance route slice | .NET 9 |
+| `DorkNet.Services.Identity` | Accounts, auth, platform login, JWT issuance route slice | .NET 9 |
 | `DorkNet.Services.Rooms` | Rooms, room keys, matchmaking, discovery route slice | .NET 9 |
 | `DorkNet.Services.Notify` | SignalR edge, messages/chat, notification fan-out route slice | .NET 9 |
 | `DorkNet.Services.Content` | CDN paths, image/photo APIs, uploads, S3-backed blobs | .NET 9 |
@@ -113,10 +113,6 @@ Compose network and forwards Cloudflare Tunnel traffic to
 configured with `DORKNET_S3_*` environment variables; the compose files
 do not run MinIO or Garage.
 
-The identity slice is the token issuer in the service split. Discovery at
-`/.well-known/openid-configuration` advertises the configured auth host,
-and access/refresh tokens minted by `/connect/token` use that same issuer.
-
 `Dockerfile.service` is the reusable service image. It accepts
 `PROJECT_PATH` and `APP_DLL` build args, rebuilds the admin/site Vite
 SPAs for service images that need static assets, publishes the selected

docs/deploy.md

@@ -42,11 +42,6 @@ shared `DorkNet.Server` controller/service stack behind route ownership
 guards, so response contracts stay identical while the architecture is
 split.
 
-Auth tokens are issued by the identity service using the configured
-auth host (`https://auth.<apex>` or the equivalent configured host style)
-as the JWT/OpenID issuer. `DORKNET_JWT_SECRET` still supplies the signing
-key for every service that validates bearer tokens.
-
 ---
 
 ## Dokploy Microservices

tools/DorkNet.ApiRouteCoverage/DorkNet.ApiRouteCoverage.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

tools/DorkNet.ApiRouteCoverage/Program.cs

@@ -51,8 +51,8 @@ static Assembly LoadServerAssembly(string[] args)
     var repositoryRoot = FindRepositoryRoot();
     var candidates = new[]
     {
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net10.0", "DorkNet.Server.dll"),
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net10.0", "DorkNet.Server.dll")
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net9.0", "DorkNet.Server.dll"),
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net9.0", "DorkNet.Server.dll")
     };
 
     var existingCandidates = candidates.Where(File.Exists).ToArray();

tools/DorkNet.EndpointContract/DorkNet.EndpointContract.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

tools/DorkNet.EndpointContract/Program.cs

@@ -333,8 +333,8 @@ static Assembly LoadServerAssembly(string? configuredPath)
     var repositoryRoot = FindRepositoryRoot();
     var candidates = new[]
     {
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net10.0", "DorkNet.Server.dll"),
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net10.0", "DorkNet.Server.dll")
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net9.0", "DorkNet.Server.dll"),
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net9.0", "DorkNet.Server.dll")
     };
     var existingCandidates = candidates.Where(File.Exists).ToArray();
     if (existingCandidates.Length == 0)

tools/cloudflared-config.coolify.yml.template

@@ -1,7 +1,7 @@
 # DorkNet Cloudflare Tunnel config — Coolify production target.
 # ────────────────────────────────────────────────────────────────────
-# Routes only DorkNet's known service subdomains through the tunnel
-# into the server container running on Coolify. The tunnel runs as its own Coolify
+# Routes every localhost subdomain through the tunnel into the server
+# container running on Coolify. The tunnel runs as its own Coolify
 # service (or as a sidecar in the same project) and reaches the
 # server over the internal Docker network.
 #
@@ -49,93 +49,24 @@ originRequest:
   keepAliveTimeout: 10m
   noHappyEyeballs: false
 
-# Ingress rules are evaluated top-down. Replace localhost below with
-# your DORKNET_DOMAIN when installing this as a static cloudflared
-# config. Do not use a wildcard hostname: only these known client-facing
-# hosts should reach the gateway.
+# Ingress rules are evaluated top-down. The wildcard catches every
+# subdomain we don't list explicitly, so when the 2020 Rec Room client
+# (post-domain-patch) hits a niche subdomain like roomieintegrations.
+# localhost, the request still reaches the server.
 ingress:
   - hostname: localhost
     service: {{UPSTREAM}}
     originRequest:
       httpHostHeader: localhost
 
-  - hostname: admin.localhost
-    service: {{UPSTREAM}}
-  - hostname: api.localhost
-    service: {{UPSTREAM}}
-  - hostname: accounts.localhost
-    service: {{UPSTREAM}}
-  - hostname: auth.localhost
-    service: {{UPSTREAM}}
-  - hostname: bugreporting.localhost
-    service: {{UPSTREAM}}
-  - hostname: cards.localhost
-    service: {{UPSTREAM}}
-  - hostname: cdn.localhost
-    service: {{UPSTREAM}}
-  - hostname: chat.localhost
-    service: {{UPSTREAM}}
-  - hostname: clubs.localhost
-    service: {{UPSTREAM}}
-  - hostname: cms.localhost
-    service: {{UPSTREAM}}
-  - hostname: commerce.localhost
-    service: {{UPSTREAM}}
-  - hostname: data.localhost
-    service: {{UPSTREAM}}
-  - hostname: datacollection.localhost
-    service: {{UPSTREAM}}
-  - hostname: discovery.localhost
-    service: {{UPSTREAM}}
-  - hostname: econ.localhost
-    service: {{UPSTREAM}}
-  - hostname: feed.localhost
-    service: {{UPSTREAM}}
-  - hostname: gamelogs.localhost
-    service: {{UPSTREAM}}
-  - hostname: geo.localhost
-    service: {{UPSTREAM}}
-  - hostname: img.localhost
-    service: {{UPSTREAM}}
-  - hostname: leaderboard.localhost
-    service: {{UPSTREAM}}
-  - hostname: link.localhost
-    service: {{UPSTREAM}}
-  - hostname: lists.localhost
-    service: {{UPSTREAM}}
-  - hostname: match.localhost
-    service: {{UPSTREAM}}
-  - hostname: moderation.localhost
-    service: {{UPSTREAM}}
-  - hostname: ns.localhost
-    service: {{UPSTREAM}}
-  - hostname: notify.localhost
-    service: {{UPSTREAM}}
-  - hostname: platformnotifications.localhost
-    service: {{UPSTREAM}}
-  - hostname: playersettings.localhost
-    service: {{UPSTREAM}}
-  - hostname: roomcomments.localhost
-    service: {{UPSTREAM}}
-  - hostname: roomieintegrations.localhost
-    service: {{UPSTREAM}}
-  - hostname: rooms.localhost
-    service: {{UPSTREAM}}
-  - hostname: storage.localhost
-    service: {{UPSTREAM}}
-  - hostname: strings.localhost
-    service: {{UPSTREAM}}
-  - hostname: strings-cdn.localhost
-    service: {{UPSTREAM}}
-  - hostname: studio.localhost
-    service: {{UPSTREAM}}
-  - hostname: thorn.localhost
-    service: {{UPSTREAM}}
-  - hostname: videos.localhost
-    service: {{UPSTREAM}}
-  - hostname: www.localhost
+  - hostname: "*.localhost"
     service: {{UPSTREAM}}
+    # cloudflared forwards the original Host header by default, which
+    # is what the server's [Host("api.localhost")] etc. attributes match
+    # against. No explicit httpHostHeader here so wildcards stay
+    # transparent.
 
   # Catch-all rejects anything that didn't match (defensive — the
-  # tunnel only routes traffic for hostnames listed above).
+  # tunnel only routes traffic for hostnames we've added DNS records
+  # for, so this is rarely reached).
   - service: http_status:404

tools/cloudflared-config.yml.template

@@ -1,7 +1,7 @@
 # DorkNet Cloudflare Tunnel config
 # ────────────────────────────────────────────────────────────────────
-# Routes only DorkNet's known localhost service subdomains through the
-# tunnel into the local server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
+# Routes every localhost subdomain through the tunnel into the local
+# server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
 # — copy to %USERPROFILE%\.cloudflared\config.yml and replace the
 # {{TUNNEL_ID}} / {{CREDENTIALS_FILE}} placeholders.
 #
@@ -14,96 +14,27 @@
 tunnel: {{TUNNEL_ID}}
 credentials-file: {{CREDENTIALS_FILE}}
 
-originRequest:
-  noTLSVerify: true
-
-# Ingress rules are evaluated top-down. Keep this list aligned with
-# DorkNetRouteOwnership.PublicSubdomains and ConfigService.ServiceSubdomains.
-# Do not use *.localhost here: only the subdomains the client actually
-# needs should reach the gateway/server.
+# Ingress rules are evaluated top-down. The wildcard catches every
+# subdomain we don't list explicitly, so when the 2020 Rec Room client
+# (post-domain-patch) hits a niche subdomain like roomieintegrations.
+# localhost, the request still reaches the server.
 ingress:
   - hostname: localhost
     service: https://localhost:443
     originRequest:
+      noTLSVerify: true
       httpHostHeader: localhost
 
-  - hostname: admin.localhost
-    service: https://localhost:443
-  - hostname: api.localhost
-    service: https://localhost:443
-  - hostname: accounts.localhost
-    service: https://localhost:443
-  - hostname: auth.localhost
-    service: https://localhost:443
-  - hostname: bugreporting.localhost
-    service: https://localhost:443
-  - hostname: cards.localhost
-    service: https://localhost:443
-  - hostname: cdn.localhost
-    service: https://localhost:443
-  - hostname: chat.localhost
-    service: https://localhost:443
-  - hostname: clubs.localhost
-    service: https://localhost:443
-  - hostname: cms.localhost
-    service: https://localhost:443
-  - hostname: commerce.localhost
-    service: https://localhost:443
-  - hostname: data.localhost
-    service: https://localhost:443
-  - hostname: datacollection.localhost
-    service: https://localhost:443
-  - hostname: discovery.localhost
-    service: https://localhost:443
-  - hostname: econ.localhost
-    service: https://localhost:443
-  - hostname: feed.localhost
-    service: https://localhost:443
-  - hostname: gamelogs.localhost
-    service: https://localhost:443
-  - hostname: geo.localhost
-    service: https://localhost:443
-  - hostname: img.localhost
-    service: https://localhost:443
-  - hostname: leaderboard.localhost
-    service: https://localhost:443
-  - hostname: link.localhost
-    service: https://localhost:443
-  - hostname: lists.localhost
-    service: https://localhost:443
-  - hostname: match.localhost
-    service: https://localhost:443
-  - hostname: moderation.localhost
-    service: https://localhost:443
-  - hostname: ns.localhost
-    service: https://localhost:443
-  - hostname: notify.localhost
-    service: https://localhost:443
-  - hostname: platformnotifications.localhost
-    service: https://localhost:443
-  - hostname: playersettings.localhost
-    service: https://localhost:443
-  - hostname: roomcomments.localhost
-    service: https://localhost:443
-  - hostname: roomieintegrations.localhost
-    service: https://localhost:443
-  - hostname: rooms.localhost
-    service: https://localhost:443
-  - hostname: storage.localhost
-    service: https://localhost:443
-  - hostname: strings.localhost
-    service: https://localhost:443
-  - hostname: strings-cdn.localhost
-    service: https://localhost:443
-  - hostname: studio.localhost
-    service: https://localhost:443
-  - hostname: thorn.localhost
-    service: https://localhost:443
-  - hostname: videos.localhost
-    service: https://localhost:443
-  - hostname: www.localhost
+  - hostname: "*.localhost"
     service: https://localhost:443
+    originRequest:
+      noTLSVerify: true
+      # Forward the original Host header verbatim so the server's
+      # [Host("api.localhost")] etc. attributes match correctly.
+      # (cloudflared does this by default; setting it explicitly so
+      # config.yml is self-documenting.)
 
   # Catch-all rejects anything that didn't match (defensive — the
-  # tunnel only routes traffic for hostnames listed above).
+  # tunnel only routes traffic for hostnames we've added DNS records
+  # for, so this is rarely reached).
   - service: http_status:404

tools/setup-cloudflared.ps1

@@ -78,15 +78,19 @@ $Template = Join-Path $PSScriptRoot 'cloudflared-config.yml.template'
 $CfDir    = Join-Path $env:USERPROFILE '.cloudflared'
 $ConfigPath = Join-Path $CfDir 'config.yml'
 
-# Subdomains routed through the tunnel. Keep this list aligned with
-# DorkNetRouteOwnership.PublicSubdomains and the cloudflared config
-# template. We intentionally create explicit DNS routes instead of a
-# wildcard so unrelated subdomains do not reach the gateway.
+# Subdomains we want routed through the tunnel. The wildcard route in
+# config.yml catches everything; this list drives the per-subdomain
+# DNS CNAMEs Cloudflare needs (no automatic wildcard CNAME via the
+# CLI — each one is created explicitly via `cloudflared tunnel route
+# dns`).
 $Subdomains = @(
     '@',                        # apex (localhost itself)
     'admin', 'api', 'accounts', 'auth', 'cdn', 'chat', 'commerce',
     'discovery', 'econ', 'feed', 'geo', 'img', 'match', 'notify',
     'ns', 'playersettings', 'rooms', 'storage', 'strings', 'strings-cdn',
+    # Long-tail subdomains DorkNet's stub controllers ack — adding
+    # CNAMEs for these means the patched client never hits a NXDOMAIN
+    # for any of the URLs it might probe.
     'bugreporting', 'cards', 'clubs', 'cms', 'data', 'datacollection',
     'gamelogs', 'leaderboard', 'link', 'lists', 'moderation',
     'platformnotifications', 'roomcomments', 'roomieintegrations',